Impact:

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (…

CVE-2026-4867 affects the path-to-regexp library, causing catastrophic backtracking (ReDoS) when three or more parameters are used within a single URL segment separated by non-period characters. The vulnerability occurs due to inadequate backtrack protection that only works for two parameters. Attackers can exploit this to cause denial of service through regex processing delays. The issue is fixed in path-to-regexp@0.1.13, with workarounds including custom regex patterns or URL length limiting available for older versions.