Security Bulletin:Catastrophic Backtracking Vulnerability in path-to-regexp with Three or More Parameters

Summary Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in path-to-regexp

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in path-to-regexp. CVE-2026-4867 The vulnerability have been addressed. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time...

Security Bulletin: There is a vulnerability in path-to-regexp-0.1.12.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-4867)

Summary There is a vulnerability in path-to-regexp-0.1.12.tgz used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you have three or more parameters within a single...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the path-to-regexp package

Summary Due to use of the path-to-regexp package, DevOps Test Performance and Rational Performance Tester contain a potential Regular Expression Denial of Service ReDoS vulnerability. Vulnerability Details CVEID:CVE-2026-4867 DESCRIPTION: Impact: A bad regular expression is generated any time you...

CVE-2026-4867 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, sqlpad, kubeflow-centraldashboard, arangodb, kubescape-grype-offline-db, pelias-api, thingsboard-fips, argo-workflows, kubeflow-katib, kubeflow-pipelines, gitlab-rails-ce-fips, py3-captum, wazuh-dashboard, wazuh-dashboard-fips, gitlab-rails-c...

CVE-2026-4867 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two...

CVE-2026-4867

CVE-2026-4867 affects the path-to-regexp library. When three or more parameters occur within a single segment (e.g., /:a-:b-:c or /:a-:b-:c-:d) a bad regular expression is generated, and the backtrack protection added in [email protected] only guards two parameters. As a result, lookaheads ca...

07-cesar-router (0.0.2), 07-custom-router (>=0.0.1, <=0.0.4) +1535 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=4.0.3, <=6.2.2)

path-to-regexp NPM version =4.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.1, =0.0.5, =0.0.1, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

10chars-test (>=1.0.0, <=1.0.34), 128981semzub (1.0.1) +1469 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=0.2.5, <=1.8.0)

path-to-regexp NPM version =0.2.5, =1.0.0, =4.0.61, =4.0.61, =4.0.61, =0.0.3, =0.0.1, =1.1.11, =2.0.0, =0.0.1, =1.0.0, =3.3.9-patch.1, =3.0.0-beta.5, =3.0.3 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

06-react-router-myself (>=0.0.1, <=0.0.2), 07-building-a-router (>=0.0.1, <=0.0.2) +200 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=7.0.0, <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...

360shitu (0.1.0), 3d-crystal-model (0.1.0) +8414 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=2.0.0, <=3.2.0)

path-to-regexp NPM version =2.0.0, =0.24.0, =1.0.0, =1.0.6, =0.0.0-canary.1, =0.0.1, =6.1.5, =1.1.17, =1.2.151 - @21epub/pro-layout 6.10.9 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: OSV:GHSA-9WV6-86V2-598J...