---
title: "GHSA-j3q9-mxjg-w52f: path-to-regexp vulnerable to Denial of Service via sequential optional groups"
description: "High severity. path-to-regexp vulnerable to Denial of Service via sequential optional groups. Affects path-to-regexp; fixed in 8.4.0."
url: https://inlinr.com/advisories/GHSA-j3q9-mxjg-w52f
lang: en
---

[Packages](https://inlinr.com/packages) / [path-to-regexp](https://inlinr.com/packages/path-to-regexp) / [Security](https://inlinr.com/packages/path-to-regexp/security)

High Vulnerability GHSA-j3q9-mxjg-w52f CVE-2026-4926 Published 27 Mar 2026

# path-to-regexp vulnerable to Denial of Service via sequential optional groups

Your version 

Affected releases · [path-to-regexp](https://inlinr.com/packages/path-to-regexp)

- 8.x 8.0.0 – 8.3.0 Fixed in 8.4.0

On 8.x, the newest line:

```
npm install path-to-regexp@8.4.0
```

Every release on a timeline

9.x 

1. Not affected

9.0.0  
1 release, latest

8.x 

1. Affected

8.0.0 – 8.3.0  
4 releases
2. Fixed

8.4.0 – 8.4.2  
3 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

## What happens

Impact

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches

Fixed in version 8.4.0.

Workarounds

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f")  
github.com/pillarjs/path-to-regexp/security/adv…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-4926 "https://nvd.nist.gov/vuln/detail/CVE-2026-4926")  
nvd.nist.gov/vuln/detail/CVE-2026-4926
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/pillarjs/path-to-regexp "https://github.com/pillarjs/path-to-regexp")  
github.com/pillarjs/path-to-regexp