Skip to content
OpenAdvisories

Vendor

path-to-regexp

3 known vulnerabilities.

Products

path-to-regexp 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.5
    CVE-2026-4926

    path-to-regexp vulnerable to Denial of Service via sequential optional groups

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ve…

    path-to-regexp path-to-regexp langfuse-3-worker vitess-23 Debian Wolfi npm
  • High 7.5
    CVE-2026-4867

    path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

    Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 …

    path-to-regexp path-to-regexp katib-suggestion-hyperopt katib-earlystopping Debian Wolfi