Junglewise Threat Intelligence

CVE-2026-4926: path-to-regexp denial of service via sequential optional groups

CVE-2026-4926 · Severity: high · CVSS 7.5 · Published 2026-03-26

Technologies: Red Hat Trusted Artifact Signer, path-to-regexp (npm), Red Hat Ansible Automation Platform, Red Hat Developer Hub. Vendors: Red Hat, npm, OpenJS Foundation.

Executive brief

A vulnerability in the path-to-regexp library, which is used to handle web application routing, can allow an attacker to crash a service. By providing specific inputs that trigger complex internal calculations, an attacker can cause the system to become unresponsive, leading to a denial of service. This affects various enterprise tools including Red Hat's Ansible Automation Platform and Trusted Artifact Signer.

Technical details

The path-to-regexp library (prior to version 8.4.0) suffers from a Regular Expression Denial of Service (ReDoS) vulnerability. When the library processes route patterns containing multiple sequential optional groups (using curly brace syntax like {a}{b}{c}), it generates a regular expression that grows exponentially in complexity. An attacker can exploit this by providing inputs that trigger this exponential growth, leading to uncontrolled resource consumption (CWE-400) and CPU exhaustion (CWE-1333). The vulnerability is reachable over the network without authentication if user-controlled input is passed into route patterns. The issue is fixed in version 8.4.0.

Affected products

  • OpenJS Foundation path-to-regexp < 8.4.0
  • Red Hat Red Hat Trusted Artifact Signer (RHTAS)
  • Red Hat Red Hat Ansible Automation Platform
  • Red Hat Red Hat Developer Hub

Timeline

  • 2026-03-26: disclosed
  • 2026-03-26: advisory
  • 2026-04-23: patched: Red Hat issued patches for RHTAS via RHSA-2026:10153

References

Related threats