EUVD-2026-16322Published

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

cve-program · CVE-2026-4923

Published

path-to-regexp

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "path-to-regexp",
                    "product": "path-to-regexp",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "versionType": "semver",
                            "status": "affected",
                            "version": "8.0.0",
                            "lessThan": "8.4.0"
                        },
                        {
                            "versionType": "semver",
                            "status": "unaffected",
                            "version": "8.4.0"
                        }
                    ],
                    "packageURL": "pkg:npm/path-to-regexp"
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-16322

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 26, 2026, 7:02:00 PM

dateUpdated: Mar 27, 2026, 1:58:03 PM

3 related source bulletins · separate from aliases

WID-SEC-W-2026-1407: IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen

CVE-2026-26013 · CVE-2026-27142 · CVE-2026-28277 · CVE-2026-28684 · CVE-2026-32288 · CVE-2026-33151 · CVE-2026-33349 · CVE-2026-33532 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-33916 · CVE-2026-34601 · CVE-2026-35469 · CVE-2026-39406 · CVE-2026-39407 · CVE-2026-39408 · CVE-2026-39409 · CVE-2026-39410 · CVE-2026-39983 · CVE-2026-40175 · CVE-2026-40347 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-4923 · CVE-2026-4926

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

RHSA-2026:24841: Red Hat Security Advisory: Red Hat Developer Hub 1.10.0 release.

CVE-2026-2950 · CVE-2026-4923 · CVE-2026-22036 · CVE-2026-27601 · CVE-2026-31988 · CVE-2026-32235 · CVE-2026-33349

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-4923

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-1333

Original publisher date fields

published: 2026-03-26T19:17:08.187

lastModified: 2026-06-17T10:57:27.740

1 source CPE criteria · context only

cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-27v5-c462-wpq7

Published

path-to-regexp

npm

SEMVER · introduced 8.0.0 → fixed 8.4.0

Original source record · Cite this exact observation · Complete original publisher JSON