---
title: "GHSA-27v5-c462-wpq7: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards"
description: "Moderate severity. path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards. Affects path-to-regexp; fixed in 8.4.0."
url: https://inlinr.com/advisories/GHSA-27v5-c462-wpq7
lang: en
---

[Packages](https://inlinr.com/packages) / [path-to-regexp](https://inlinr.com/packages/path-to-regexp) / [Security](https://inlinr.com/packages/path-to-regexp/security)

Moderate Vulnerability GHSA-27v5-c462-wpq7 CVE-2026-4923 Published 27 Mar 2026

# path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Your version 

Affected releases · [path-to-regexp](https://inlinr.com/packages/path-to-regexp)

- 8.x 8.0.0 – 8.3.0 Fixed in 8.4.0

On 8.x, the newest line:

```
npm install path-to-regexp@8.4.0
```

Every release on a timeline

9.x 

1. Not affected

9.0.0  
1 release, latest

8.x 

1. Affected

8.0.0 – 8.3.0  
4 releases
2. Fixed

8.4.0 – 8.4.2  
3 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

## What happens

Impact

When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.

**Unsafe examples:**

```
/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y
```

**Safe examples:**

```
/*foo-:bar
/*foo-:bar-*baz
```

Patches

Upgrade to version `8.4.0`.

Workarounds

If developers are using multiple wildcard parameters, they can check the regex output with a tool such as [makenowjust-labs.github.io/recheck/playground/](https://makenowjust-labs.github.io/recheck/playground/ "https://makenowjust-labs.github.io/recheck/playground/") to confirm whether a path is vulnerable.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7 "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7")  
github.com/pillarjs/path-to-regexp/security/adv…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-4923 "https://nvd.nist.gov/vuln/detail/CVE-2026-4923")  
nvd.nist.gov/vuln/detail/CVE-2026-4923
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/pillarjs/path-to-regexp "https://github.com/pillarjs/path-to-regexp")  
github.com/pillarjs/path-to-regexp
- [Reference](https://makenowjust-labs.github.io/recheck/playground "https://makenowjust-labs.github.io/recheck/playground")  
makenowjust-labs.github.io/recheck/playground