CVE-2026-62864

Name of the Vulnerable Software and Affected Versions Ring versions prior to 1.15.5

Description The wrap-nested-params function in the ring.middleware.nested-params namespace uses a backtracking regular expression to match parameter names from URL query strings and HTTP request bodies. An attacker can provide a specially crafted parameter name that triggers quadratic O(n^2) matching work, leading to a regular-expression denial of service. Users of Ring-Defaults are also affected as this middleware is enabled by default.

Recommendations Update to version 1.15.5. As a temporary mitigation, avoid using the wrap-nested-params middleware.