Path To Regexp

How Denial of Service via Regular Expression Happens in Node.js Dependencies and How to Fix It

A high-severity denial of service vulnerability in the `path-to-regexp` package (CVE-2026-4926) could allow attackers to craft malicious regular expressions that consume excessive CPU resources. The fix upgrades from version 8.2.0 to 8.4.0, which hardens regex handling and prevents ReDoS (Regular Expression Denial of Service) attacks in Express applications.