https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4926.htmlhttps://patchthecve.com/cve/CVE-2026-4926.htmlWed, 09 Sep 2026 13:20:25 +0000HIGH 7.5: Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in version 8.4.0. Workarounds: Limit the https://patchthecve.com/cve/CVE-2026-4923.htmlhttps://patchthecve.com/cve/CVE-2026-4923.htmlWed, 17 Jun 2026 10:57:27 +0000MEDIUM 5.9: Impact: When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path. Unsafe examples: /*foo-*bar-:baz /*a-:b-*c-:https://patchthecve.com/cve/CVE-2026-4867.htmlhttps://patchthecve.com/cve/CVE-2026-4867.htmlWed, 17 Jun 2026 10:57:21 +0000HIGH 7.5: Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two paramete