<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w" -->

---
title: March 2026 Security Releases · Express.js | daily.dev
description: Three regular expression denial of service (ReDoS) vulnerabilities have been patched in path-to-regexp, the routing library used by Express.js. CVE-2026-4867...
canonical: https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: March 2026 Security Releases · Express.js | daily.dev
og:description: Three regular expression denial of service (ReDoS) vulnerabilities have been patched in path-to-regexp, the routing library used by Express.js. CVE-2026-4867...
og:url: https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w
og:image: https://api.daily.dev/og/posts/WEOB3Eh6w.png
og:image:alt: March 2026 Security Releases · Express.js
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# March 2026 Security Releases · Express.js

**[Express.js](https://daily.dev/sources/expressjs-blog)** · 2 min read · 0 upvotes · 0 comments

## Summary

Three regular expression denial of service (ReDoS) vulnerabilities have been patched in path-to-regexp, the routing library used by Express.js. CVE-2026-4867 affects versions <= 0.1.12 via three or more route parameters in a segment; CVE-2026-4926 affects versions >= 8.0.0 via sequential optional groups; CVE-2026-4923 affects versions 8.0.0-8.3.0 via multiple wildcards. Users are urged to upgrade to patched versions (>= 0.1.13 or >= 8.4.0 depending on branch) as soon as possible.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://expressjs.com/en/blog/2026-03-30-security-releases>

## Questions this post answers

### What is CVE-2026-4867 in path-to-regexp and which versions are affected?

CVE-2026-4867 is a high-severity regular expression denial of service vulnerability in path-to-regexp versions 0.1.12 and below. It occurs when a route has three or more parameters within a single segment separated by something other than a period, such as /:a-:b-:c, because the backtrack protection added in 0.1.12 only guards against two parameters. Upgrading to 0.1.13 or later patches the issue.

_Teams patching Express.js routing dependencies can track ReDoS advisories like this one on daily.dev._

### How do I fix the ReDoS vulnerability in path-to-regexp caused by sequential optional groups?

Upgrade path-to-regexp to version 8.4.0 or later, which patches CVE-2026-4926. Versions 8.0.0 and above are vulnerable when a route pattern contains multiple sequential optional groups, such as {a}{b}{c}:z, because the generated regex grows exponentially with each group, enabling denial of service. Avoid passing user-controlled input directly as route patterns.

_Developers auditing Express dependency versions can follow patch guidance like this through daily.dev._

### What causes the path-to-regexp wildcard ReDoS vulnerability CVE-2026-4923?

CVE-2026-4923 is a medium-severity ReDoS affecting path-to-regexp versions 8.0.0 through 8.3.0, triggered when a route pattern uses multiple wildcards combined with at least one parameter and the second wildcard is not at the end of the path, for example /*foo-*bar-:baz. Upgrading to version 8.4.0 or later resolves it.

_Staying on top of routing library CVEs like this helps developers on daily.dev secure Express apps faster._

## Similar posts on daily.dev

- [July 2026 Security Releases · Express.js](https://daily.dev/posts/july-2026-security-releases-express-js-tcsj3rcgu) · Express.js · 1 upvotes · 1 comments
- [August 2026 Security Releases · Express.js](https://daily.dev/posts/august-2026-security-releases-express-js-kdzxqxlti) · Express.js · 2 upvotes · 0 comments
- [Next.js May 2026 security release](https://daily.dev/posts/next-js-may-2026-security-release-hmqrmcava) · Vercel · 131 upvotes · 4 comments
- [minimatch Patches 3 High-Severity ReDoS Vulnerabilities](https://daily.dev/posts/minimatch-patches-3-high-severity-redos-vulnerabilities-evvwdjaxe) · Socket · 1 upvotes · 0 comments
- [Node.js — Node.js 26.5.1 \(Current\)](https://daily.dev/posts/node-js-node-js-26-5-1-current--hx951gecs) · Node.js · 25 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#nodejs](https://daily.dev/tags/nodejs)

[View this post on daily.dev](https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"March 2026 Security Releases · Express.js","url":"https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w"},"datePublished":"2026-08-23T12:17:24.874Z","dateModified":"2026-08-23T12:20:42.739Z","description":"Three regular expression denial of service (ReDoS) vulnerabilities have been patched in path-to-regexp, the routing library used by Express.js. CVE-2026-4867...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff5a56b4c95c44c435235d494935a0f7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ff5a56b4c95c44c435235d494935a0f7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Express.js","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Express.js","logo":"https://media.daily.dev/image/upload/s--NvBVN7aT--/f_auto,q_auto/v1787487436/logos/expressjs-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/expressjs-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,nodejs","timeRequired":"PT2M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Express.js","item":"https://daily.dev/sources/expressjs-blog"},{"@type":"ListItem","position":3,"name":"March 2026 Security Releases · Express.js"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/march-2026-security-releases-express-js-weob3eh6w#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-4867 in path-to-regexp and which versions are affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-4867 is a high-severity regular expression denial of service vulnerability in path-to-regexp versions 0.1.12 and below. It occurs when a route has three or more parameters within a single segment separated by something other than a period, such as /:a-:b-:c, because the backtrack protection added in 0.1.12 only guards against two parameters. Upgrading to 0.1.13 or later patches the issue. Teams patching Express.js routing dependencies can track ReDoS advisories like this one on daily.dev."}},{"@type":"Question","name":"How do I fix the ReDoS vulnerability in path-to-regexp caused by sequential optional groups?","acceptedAnswer":{"@type":"Answer","text":"Upgrade path-to-regexp to version 8.4.0 or later, which patches CVE-2026-4926. Versions 8.0.0 and above are vulnerable when a route pattern contains multiple sequential optional groups, such as {a}{b}{c}:z, because the generated regex grows exponentially with each group, enabling denial of service. Avoid passing user-controlled input directly as route patterns. Developers auditing Express dependency versions can follow patch guidance like this through daily.dev."}},{"@type":"Question","name":"What causes the path-to-regexp wildcard ReDoS vulnerability CVE-2026-4923?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-4923 is a medium-severity ReDoS affecting path-to-regexp versions 8.0.0 through 8.3.0, triggered when a route pattern uses multiple wildcards combined with at least one parameter and the second wildcard is not at the end of the path, for example /*foo-*bar-:baz. Upgrading to version 8.4.0 or later resolves it. Staying on top of routing library CVEs like this helps developers on daily.dev secure Express apps faster."}}]}
```