# CVE-2026-4926: path-to-regexp denial of service via sequential optional groups

Source: https://junglewise.ai/threats/cve-2026-4926-path-to-regexp-denial-of-service-via-sequential-optional-groups  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-26. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-4926 · Severity: high · CVSS 7.5 · Published 2026-03-26

A vulnerability in the path-to-regexp library, which is used to handle web application routing, can allow an attacker to crash a service. By providing specific inputs that trigger complex internal calculations, an attacker can cause the system to become unresponsive, leading to a denial of service. This affects various enterprise tools including Red Hat's Ansible Automation Platform and Trusted Artifact Signer.

Technologies: [path-to-regexp (npm)](https://junglewise.ai/threats/technologies/path-to-regexp), [Red Hat Developer Hub](https://junglewise.ai/threats/technologies/developer-hub), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-4926 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4926 being exploited in the wild.

**How severe is CVE-2026-4926?** High severity, with a CVSS score of 7.5, published 26 March 2026.

**Which products and versions are affected?** path-to-regexp (npm) SEMVER:introduced=8.0.0,fixed=8.4.0.

**Is there a fix for CVE-2026-4926?** Yes. path-to-regexp (npm): upgrade to 8.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-4926 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4926?** Check whether you run path-to-regexp (npm), Red Hat Developer Hub or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- path-to-regexp (npm): upgrade to 8.4.0 or later

  ```sh
  npm install path-to-regexp@8.4.0
  ```


## Technical details

The path-to-regexp library (prior to version 8.4.0) suffers from a Regular Expression Denial of Service (ReDoS) vulnerability. When the library processes route patterns containing multiple sequential optional groups (using curly brace syntax like {a}{b}{c}), it generates a regular expression that grows exponentially in complexity. An attacker can exploit this by providing inputs that trigger this exponential growth, leading to uncontrolled resource consumption (CWE-400) and CPU exhaustion (CWE-1333). The vulnerability is reachable over the network without authentication if user-controlled input is passed into route patterns. The issue is fixed in version 8.4.0.

## Affected products

- OpenJS Foundation path-to-regexp < 8.4.0
- Red Hat Red Hat Trusted Artifact Signer (RHTAS)
- Red Hat Red Hat Ansible Automation Platform
- Red Hat Red Hat Developer Hub

## Identifiers

- CVE-2026-4926
- GHSA-j3q9-mxjg-w52f

## Timeline

- 2026-03-26: disclosed
- 2026-03-26: advisory
- 2026-04-23: patched: Red Hat issued patches for RHTAS via RHSA-2026:10153

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://access.redhat.com/errata/RHSA-2026:10153](https://access.redhat.com/errata/RHSA-2026:10153)
- [https://access.redhat.com/errata/RHSA-2026:10172](https://access.redhat.com/errata/RHSA-2026:10172)
- [https://access.redhat.com/errata/RHSA-2026:10175](https://access.redhat.com/errata/RHSA-2026:10175)
- [https://access.redhat.com/errata/RHSA-2026:13545](https://access.redhat.com/errata/RHSA-2026:13545)
- [https://access.redhat.com/errata/RHSA-2026:13826](https://access.redhat.com/errata/RHSA-2026:13826)
- [https://access.redhat.com/errata/RHSA-2026:17789](https://access.redhat.com/errata/RHSA-2026:17789)

## Related threats

- [patriksimek vm2 remote code execution via NodeVM allowlist bypass](https://junglewise.ai/threats/cve-2026-43999-patriksimek-vm2-remote-code-execution-via-nodevm-allowlist-bypass)
- [patriksimek vm2 remote code execution via symlink traversal in NodeVM](https://junglewise.ai/threats/cve-2026-43998-patriksimek-vm2-remote-code-execution-via-symlink-traversal-in)
- [protobufjs code injection in toObject function generation](https://junglewise.ai/threats/cve-2026-44293-protobufjs-code-injection-in-toobject-function-generation)
- [Fastify fast-uri host confusion via percent-encoded authority delimiters](https://junglewise.ai/threats/cve-2026-6322-fastify-fast-uri-host-confusion-via-percent-encoded-authority)
- [OpenJS Foundation fast-uri path traversal via percent-encoded dot segments](https://junglewise.ai/threats/cve-2026-6321-openjs-foundation-fast-uri-path-traversal-via-percent-encoded-dot)