« Volver al listado

CVE-2026-4867

Estado: AnalizadaAlta (7.5)—

Impact:

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.

Patches:

Upgrade to path-to-regexp@0.1.13

Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.

Leer descripción completaMostrar menos

Workarounds:

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Pillarjs — Path-to-regexp

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-4867",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-4867",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-26T16:52:08.810671Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "affectedData": [
        {
          "vendor": "path-to-regexp",
          "product": "path-to-regexp",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.1.13",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:npm/path-to-regexp",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-26T17:16:42.983",
  "references": [
    {
      "url": "https://blakeembrey.com/posts/2024-09-web-redos",
      "tags": [
        "Technical Description"
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    },
    {
      "url": "https://cna.openjsf.org/security-advisories.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    },
    {
      "url": "https://github.com/advisories/GHSA-9wv6-86v2-598j",
      "tags": [
        "Not Applicable"
      ],
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ce714d77-add3-4f53-aff5-83d477b104bb",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Impact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\nCustom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.\n\nWorkarounds:\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length."
    },
    {
      "lang": "es",
      "value": "Impacto:\n\nSe genera una expresión regular incorrecta cada vez que se tienen tres o más parámetros dentro de un único segmento, separados por algo que no sea un punto (.). Por ejemplo, /:a-:b-:c o /:a-:b-:c-:d. La protección contra retroceso añadida en path-to-regexp@0.1.12 solo previene la ambigüedad para dos parámetros. Con tres o más, el 'lookahead' generado no bloquea los caracteres separadores individuales, por lo que los grupos de captura se superponen y causan un retroceso catastrófico.\n\nParches:\n\nActualizar a path-to-regexp@0.1.13\n\nLos patrones de expresiones regulares personalizados en las definiciones de ruta (por ejemplo, /:a-:b([^-/]+)-:c([^-/]+)) no se ven afectados porque anulan el grupo de captura predeterminado.\n\nSoluciones provisionales:\n\nTodas las versiones pueden ser parcheadas proporcionando una expresión regular personalizada para los parámetros después del primero en un único segmento. Siempre y cuando la expresión regular personalizada no coincida con el texto anterior al parámetro, estará seguro. Por ejemplo, cambie /:a-:b-:c a /:a-:b([^-/]+)-:c([^-/]+).\n\nSi las rutas no pueden ser reescritas y las versiones no pueden ser actualizadas, otra alternativa es limitar la longitud de la URL."
    }
  ],
  "lastModified": "2026-06-17T10:57:21.827",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD9DFD27-4A53-4409-9DAC-8E326EBB3303",
              "versionEndExcluding": "0.1.13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"
}