Loading story…
Two disclosed vulnerabilities, CVE-2026-4923 and CVE-2026-4926, affect the widely used path-to-regexp library and can cause regular expression denial of service (ReDoS) in Node.js applications. In both cases, crafted input can trigger catastrophic backtracking in route-matching logic, consuming CPU and memory and blocking the single-threaded Node.js event loop so applications stop processing HTTP requests, timers, and asynchronous callbacks.
The flaws primarily impact availability rather than confidentiality or integrity. CVE-2026-4923 was rated CVSS 5.9 and depends on specific developer-defined routing configurations, with simple routing patterns reportedly unaffected, while CVE-2026-4926 was rated CVSS 7.5 with low attack complexity and no required privileges or user interaction. Although reported exploitation likelihood remains low, the library’s broad adoption across the Node.js ecosystem increases exposure, particularly for applications that allow externally influenced route definitions.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Two denial-of-service vulnerabilities affecting path-to-regexp were publicly documented. Both issues can cause Node.js applications to become unresponsive through catastrophic regular-expression backtracking that blocks the single-threaded event loop.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat issued security updates for OpenShift and related products to remediate **CVE-2024-45296** in `path-to-regexp` and **CVE-2024-43796** in Express.js. The `path-to-regexp` flaw permits regular-expression denial of service when a crafted route pattern places two parameters in one path segment separated by a non-period character, potentially blocking Node.js's single-threaded event loop. Express versions before 4.20.0 can improperly handle untrusted input passed to `response.redirect()`, potentially enabling execution of untrusted code even when the input has been sanitized. Affected updates include OpenShift Data Foundation 4.14.13, 4.15.9, and 4.17.0 container images, as well as OpenShift Container Platform 4.17 releases and other Red Hat offerings such as OpenShift Service Mesh, Serverless, OpenShift AI, Dev Spaces, Network Observability, and the Red Hat build of Apache Camel. The advisories also address additional bundled-component flaws, including prototype pollution, unsafe redirects, DOM clobbering, resource exhaustion, and potential code execution. Administrators should apply the applicable Red Hat errata and upgrade `path-to-regexp` to 0.1.10 on the 0.1 branch or 8.0.0 on other branches, and Express to 4.20.0 or later.
Aug 27, 2026
Red Hat released **Important** security updates for **Node.js 22** across **RHEL 8, RHEL 9, RHEL 9.6 EUS, and RHEL 10**, rebasing affected packages to **Node.js 22.22.2** and updating related RPMs for `x86_64`, `aarch64`, `ppc64le`, and `s390x`. The advisories cover multiple vulnerabilities in Node.js and bundled components including **brace-expansion**, **minimatch**, **undici**, and **nghttp2**, with impacts dominated by denial-of-service conditions and one **HTTP request smuggling** flaw tied to duplicate `Content-Length` headers in `undici`. The fixes span a set of CVEs including `CVE-2026-25547`, `CVE-2026-26996`, `CVE-2026-27904`, `CVE-2026-1525`, `CVE-2026-1526`, `CVE-2026-1528`, `CVE-2026-2229`, `CVE-2026-27135`, and `CVE-2026-21710`. Red Hat’s Bugzilla entry for `CVE-2026-25547` says the **brace-expansion** package could be abused through unbounded brace range expansion, causing exponential CPU and memory consumption and potentially crashing Node.js processes; the issue was patched upstream in version **5.0.1** and incorporated into Red Hat’s errata for supported RHEL releases and lifecycle channels.
Aug 21, 2026
Multiple vulnerabilities were disclosed in the widely used React Router `npm` package, including a reported remote code execution issue tracked as **CVE-2026-42211** that researchers said could allow unauthenticated attackers to gain shell access when chained with an existing prototype pollution weakness. Additional flaws include **CVE-2026-33245**, a client-side cross-site scripting bug in redirect handling for applications using unstable React Server Components APIs, plus **CVE-2026-34077** and **CVE-2026-42342**, two denial-of-service issues tied to serialization and manifest endpoint performance that can crash or degrade backend services. The XSS issue affects React Router versions `7.7.0` through `7.13.1` when redirects originate from untrusted sources and use `javascript:` targets; applications not using the unstable RSC APIs or running in standard Declarative Mode are not impacted. Maintainers patched **CVE-2026-33245** in React Router `7.13.2`, while broader mitigation for the full set of reported issues requires upgrading to React Router `7.15.0` or Remix `2.17.5`.
Jun 29, 2026