https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-03T19:35:42.492357+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-4923 CVE-2026-4923 — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards 2026-10-03T19:35:42.506852+00:00

Affected: path-to-regexp

Impact:

When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.

Unsafe examples:

/*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y

Safe examples:

/*foo-:bar /*foo-:bar-*baz

Patches:

Upgrade to version 8.4.0.

Workarounds:

If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.