Path To Regexp EUVD-2026-16322

The CVSS 5.9 score (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a medium-severity availability impact requiring high attack complexity and unauthenticated remote access. The AV:N (network) and PR:N (no privileges required) signals demonstrate broad exploitability from the network without authentication. However, the AC:H (high complexity) modifier is significant-successful exploitation requires the application to be deployed with a specifically vulnerable path pattern configuration (multiple wildcards with non-terminal positioning), and the attacker must craft matching input that triggers the backtracking condition. The availability-only impact (A:H with C:N/I:N) limits scope to denial of service rather than confidentiality or integrity breach. Real-world risk depends on deployment patterns: applications using simple routing (single wildcards, terminal wildcards, or single parameters) are unaffected; only those matching the unsafe examples provided are at risk. The requirement for specific path configuration patterns and attack input significantly reduces the attack surface compared to the raw CVSS score suggests. EPSS data was not provided in the source data; patch availability (version 8.4.0) is confirmed, lowering ongoing risk for organizations that can upgrade promptly.

An attacker identifies an application using path-to-regexp 8.0.0-8.3.x with a route definition vulnerable to the ReDoS pattern, such as a file serving endpoint defined as /:type/*path-:format. The attacker sends a specially crafted HTTP request with a path component engineered to trigger catastrophic regex backtracking (e.g., a long string of repeated characters matching the prefix but failing at the end of the pattern). The regex engine enters exponential backtracking, consuming CPU resources and causing the application to become unresponsive to legitimate requests. This requires no authentication or user interaction, and the attack can be repeated to sustain denial of service. The AC:H complexity rating reflects that the attacker must identify or guess the specific vulnerable route pattern and construct matching input; however, once a vulnerable pattern is discovered, exploitation is trivial.