Is CVE-2026-4926 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4926 being exploited in the wild.

How severe is CVE-2026-4926?

High severity, with a CVSS score of 7.5, published 26 March 2026.

Which products and versions are affected?

path-to-regexp (npm) SEMVER:introduced=8.0.0,fixed=8.4.0.

Is there a fix for CVE-2026-4926?

Yes. path-to-regexp (npm): upgrade to 8.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4926 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4926?

Check whether you run path-to-regexp (npm), Red Hat Developer Hub or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4926: path-to-regexp denial of service via sequential optional groups

CVE-2026-4926 · Severity: high · CVSS 7.5 · Published 2026-03-26

A vulnerability in the path-to-regexp library, which is used to handle web application routing, can allow an attacker to crash a service. By providing specific inputs that trigger complex internal calculations, an attacker can cause the system to become unresponsive, leading to a denial of service. This affects various enterprise tools including Red Hat's Ansible Automation Platform and Trusted Artifact Signer.

Technologies: path-to-regexp (npm), Red Hat Developer Hub, Red Hat Trusted Artifact Signer. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-4926 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4926 being exploited in the wild.
How severe is CVE-2026-4926?: High severity, with a CVSS score of 7.5, published 26 March 2026.
Which products and versions are affected?: path-to-regexp (npm) SEMVER:introduced=8.0.0,fixed=8.4.0.
Is there a fix for CVE-2026-4926?: Yes. path-to-regexp (npm): upgrade to 8.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4926 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4926?: Check whether you run path-to-regexp (npm), Red Hat Developer Hub or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

path-to-regexp (npm): upgrade to 8.4.0 or later
```
npm install path-to-regexp@8.4.0
```

Technical details

The path-to-regexp library (prior to version 8.4.0) suffers from a Regular Expression Denial of Service (ReDoS) vulnerability. When the library processes route patterns containing multiple sequential optional groups (using curly brace syntax like {a}{b}{c}), it generates a regular expression that grows exponentially in complexity. An attacker can exploit this by providing inputs that trigger this exponential growth, leading to uncontrolled resource consumption (CWE-400) and CPU exhaustion (CWE-1333). The vulnerability is reachable over the network without authentication if user-controlled input is passed into route patterns. The issue is fixed in version 8.4.0.

Affected products

OpenJS Foundation path-to-regexp < 8.4.0
Red Hat Red Hat Trusted Artifact Signer (RHTAS)
Red Hat Red Hat Ansible Automation Platform
Red Hat Red Hat Developer Hub

Identifiers

CVE-2026-4926
GHSA-j3q9-mxjg-w52f

Timeline

2026-03-26: disclosed
2026-03-26: advisory
2026-04-23: patched: Red Hat issued patches for RHTAS via RHSA-2026:10153

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.