path-to-regexp vulnerabilities

CVEs whose affected-version data names the path-to-regexp package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-4926High· 7.5

6mo ago

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`

Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of servic…

▾ Twilightpillarjs · path-to-regexpEPSS 0.79%via NVD