path-to-regexp vulnerable to Denial of Service via sequential optional groups

🗓️ 27 Mar 2026 22:23:27Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 32 Views

path-to-regexp denial of service from sequential optional groups; fixed in version 8.4.0.

Reporter	Title	Published	Views	Family All 73
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in path-to-regexp	28 May 202613:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module path-to-regexp	16 Jun 202610:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (May 2026)	14 May 202601:21	–	ibm
IBM Security Bulletins	Security Bulletin: The Log Source Management App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	1 Jun 202616:07	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the path-to-regexp library	22 Apr 202612:13	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	27 Apr 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java, JavaScript and IBM WebSphere Application Server Liberty	28 Apr 202613:03	–	ibm
ATTACKERKB	CVE-2026-4926	26 Mar 202618:59	–	attackerkb
Chainguard	CVE-2026-4926 vulnerabilities	31 Mar 202601:17	–	cgr

Vulners

Node

pillarjs path-to-regexpRange8.0.0–8.4.0npm

Source	Link
github	www.github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4926
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/advisories/GHSA-j3q9-mxjg-w52f

27 Mar 2026 22:23Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00455

SSVC

CWE-400 CWE-1333

path to regexp denial of service sequential optional groups exponential growth version 8.4.0