CVE-2026-4926: Pillarjs Path-To-Regexp

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

Affected products

• Pillarjs Path-To-Regexp: from 8.0.0, before 8.4.0 (fixed in 8.4.0)

Published 2026-03-26. Last modified 2026-09-09.