CVE-2026-4923
Fixed in a distro release EPSS <1%CVSS 5.9
Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y Safe examples: /*foo-:bar /*foo-:bar-*baz Patches: Upgrade to version 8.4.0. Workarounds: If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Products: path-to-regexp
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | path-to-regexp | 8.4.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | code-server | 4.112.0-r2 |
| Chainguard | gemini-cli | 0.35.3-r0 |
| Chainguard | kibana-9.1 | 9.1.10-r12 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r12 |
| Chainguard | kibana-9.2 | 9.2.7-r5 |
| Chainguard | kibana-9.2-iamguarded | 9.2.7-r5 |
| Chainguard | kibana-9.3 | 9.3.3-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.3-r3 |
| Chainguard | kibana-9.3-iamguarded | 9.3.3-r4 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.179.1-r3 |
| Chainguard | langfuse-fips-3-worker | 3.179.1-r2 |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r6 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r5 |
| Chainguard | redisinsight | 3.2.0-r4 |
| Chainguard | saf | 1.6.0-r0 |
| Chainguard | thingsboard-tb-js-executor | 4.3.1.1-r0 |
| Chainguard | thingsboard-tb-web-ui | 4.3.1.1-r0 |
| Chainguard | tileserver-gl | 5.5.0-r12 |
| Chainguard | tileserver-gl-fips | 5.5.0-r12 |
| Chainguard | vitess-21 | no fix |
| Chainguard | vitess-22 | 22.0.4-r9 |
| Chainguard | vitess-23 | 23.0.3-r12 |
| Chainguard | wazuh-dashboard | 4.14.4-r1 |
| Debian 12 | node-path-to-regexp | no fix |
| Debian 13 | node-path-to-regexp | no fix |
| Debian 14 | node-path-to-regexp | 8.4.0-1 |
| Wolfi | code-server | 4.112.0-r2 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.179.1-r3 |
| Wolfi | saf | 1.6.0-r0 |
| Wolfi | thingsboard-tb-js-executor | 4.3.1.1-r0 |
| Wolfi | thingsboard-tb-web-ui | 4.3.1.1-r0 |
| Wolfi | tileserver-gl | 5.5.0-r12 |
| Wolfi | vitess-23 | 23.0.3-r12 |