path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Impact A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period .. For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameter...

EUVD-2026-16273

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters...

01-numacert (>=1.0.0, <=3.0.0), 05day (1.0.0) +15907 more potentially affected by CVE-2026-4867 via path-to-regexp (>=0.0.2, <=0.1.12)

path-to-regexp NPM version =0.0.2, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.2.3 and more Source cves: CVE-2026-4867 Source advisory: GHSA-37CH-88JC-XWX2...

Prototype Pollution

Overview locutus is a Locutus other languages' stadard libraries to JavaScript for fun and educational purposes Affected versions of this package are vulnerable to Prototype Pollution in the parsestr function. An attacker can modify the prototype of built-in objects by overriding...

CVE-2026-4926

A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of...

CVE-2026-4867

A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by crafting a malicious URL with three or more parameters in a single segment, separated by non-period characters. This causes the component to generate a bad regular expression, leading to catastrophic...

PT-2026-28588

Name of the Vulnerable Software and Affected Versions locutus versions 2.0.39 through 3.0.24 Description A prototype pollution issue exists in the parse str function of the npm package locutus. An attacker can manipulate Object.prototype by overriding RegExp.prototype.test and then providing a...

org.webjars.npm:chai-backbone (0.9.2), org.webjars.npm:jasmine-sinon (0.3.2) +3 more potentially affected by CVE-2026-4926 via org.webjars.npm:path-to-regexp (8.4.2)

org.webjars.npm:path-to-regexp MAVEN version 8.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:path-to-regexp and may be impacted: - org.webjars.npm:chai-backbone 0.9.2 - org.webjars.npm:jasmine-sinon 0.3.2 - org.webjars.npm:nise...

org.webjars.npm:chai-backbone (0.9.2), org.webjars.npm:jasmine-sinon (0.3.2) +3 more potentially affected by CVE-2026-4923 via org.webjars.npm:path-to-regexp (8.4.2)

org.webjars.npm:path-to-regexp MAVEN version 8.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:path-to-regexp and may be impacted: - org.webjars.npm:chai-backbone 0.9.2 - org.webjars.npm:jasmine-sinon 0.3.2 - org.webjars.npm:nise...

07-calito-router (>=0.0.2, <=0.0.4), 07-dey-router (>=0.0.1, <=0.0.2) +1046 more potentially affected by CVE-2026-4926 via path-to-regexp (>=8.0.0, <=8.3.0)

path-to-regexp NPM version =8.0.0, =0.0.2, =0.0.1, =0.0.0, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.2, =0.0.1-alpha.2, =0.0.1-alpha.1, =4.0.61, =4.0.61, =0.0.1, =0.3.1, =0.3.4 and more Source cves: CVE-2026-4926 Source advisory: SNYK:JS-PATHTOREGEXP-15789763...

07-calito-router (>=0.0.2, <=0.0.4), 07-dey-router (>=0.0.1, <=0.0.2) +1046 more potentially affected by CVE-2026-4923 via path-to-regexp (>=8.0.0, <=8.3.0)

path-to-regexp NPM version =8.0.0, =0.0.2, =0.0.1, =0.0.0, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.2, =0.0.1-alpha.2, =0.0.1-alpha.1, =4.0.61, =4.0.61, =0.0.1, =0.3.1, =0.3.4 and more Source cves: CVE-2026-4923 Source advisory: SNYK:JS-PATHTOREGEXP-15789765...

CVE-2026-4923 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /foo-bar-:baz /a-:b-c-:d...

CVE-2026-4923 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /foo-bar-:baz /a-:b-c-:d...

07-calito-router (>=0.0.2, <=0.0.4), 07-dey-router (>=0.0.1, <=0.0.2) +1046 more potentially affected by CVE-2026-4923 via path-to-regexp (>=8.0.0, <=8.3.0)

path-to-regexp NPM version =8.0.0, =0.0.2, =0.0.1, =0.0.0, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.2, =0.0.1-alpha.2, =0.0.1-alpha.1, =4.0.61, =4.0.61, =0.0.1, =0.3.1, =0.3.4 and more Source cves: CVE-2026-4923 Source advisory: MEND:CVE-2026-4923...

CVE-2026-4926 path-to-regexp vulnerable to Denial of Service via sequential optional groups

Impact: A bad regular expression is generated any time you have multiple sequential optional groups curly brace syntax, such as abc:z. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of...

CVE-2026-4926 path-to-regexp vulnerable to Denial of Service via sequential optional groups

Impact: A bad regular expression is generated any time you have multiple sequential optional groups curly brace syntax, such as abc:z. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of...

07-calito-router (>=0.0.2, <=0.0.4), 07-dey-router (>=0.0.1, <=0.0.2) +1046 more potentially affected by CVE-2026-4926 via path-to-regexp (>=8.0.0, <=8.3.0)

path-to-regexp NPM version =8.0.0, =0.0.2, =0.0.1, =0.0.0, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.2, =0.0.1-alpha.2, =0.0.1-alpha.1, =4.0.61, =4.0.61, =0.0.1, =0.3.1, =0.3.4 and more Source cves: CVE-2026-4926 Source advisory: MEND:CVE-2026-4926...

CVE-2026-4926 path-to-regexp vulnerable to Denial of Service via sequential optional groups

Impact: A bad regular expression is generated any time you have multiple sequential optional groups curly brace syntax, such as abc:z. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the number of...

com.codbex.aion:codbex-aion-platform (>=0.5.6, <=0.5.7), com.codbex.aion:codbex-aion-platform-keycloack (>=0.5.6, <=0.5.7) +95 more potentially affected by CVE-2024-45296 +1 more via org.webjars.npm:path-to-regexp (>=0.1.7, <=8.4.2)

org.webjars.npm:path-to-regexp MAVEN version =0.1.7, =0.5.6, =0.5.6, =0.5.6, =0.4.0, =0.4.0, =0.5.3, =0.5.5 - com.codbex.kronos:codbex-kronos-coverage-aggregate 0.4.0 - com.codbex.kronos:codbex-kronos-modules-all 0.4.0 - com.codbex.kronos:codbex-kronos-modules-engines-all 0.4.0 -...

01-numacert (>=1.0.0, <=3.0.0), 05day (1.0.0) +15907 more potentially affected by CVE-2024-45296 +1 more via path-to-regexp (>=0.0.2, <=0.1.12)

path-to-regexp NPM version =0.0.2, =1.0.0, =1.0.1, =1.0.3, =0.2.0, =1.0.2, =1.0.0, =2.0.0, =0.2.0, =0.2.0, =0.2.3 and more Source cves: CVE-2024-45296, CVE-2026-4867 Source advisory: SNYK:JS-PATHTOREGEXP-15789761...