PatchTheCVEpath-to-regexp vulnerabilities and fixes
Recent CVEs affecting path-to-regexp, with upgrade or downgrade steps. 3 tracked.
Also searched as: path to regexp.
path-to-regexp has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-03-26. Highest priority: CVE-2026-4926 (score 45/100).
- CVE-2026-4926 HIGH 7.5 UPGRADE Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly br
- CVE-2026-4923 MEDIUM 5.9 UPGRADE Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be gene
- CVE-2026-4867 HIGH 7.5 UPGRADE Impact: A bad regular expression is generated any time you have three or more parameters within a single segm
FAQ
How do I fix path-to-regexp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is path-to-regexp being exploited right now?
None of the tracked path-to-regexp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which path-to-regexp CVE should I patch first?
CVE-2026-4926 currently ranks highest (45/100): Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly br.