GHSA-37ch-88jc-xwx2
High · 7.5CVSS
7.5
EPSS
—
Published
Mar 27, 2026
CISA due date
—
The record
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | path-to-regexp | 0 | 0.1.13 |
| Chainguard | argo-workflows-ui-3.6 | 0 | 3.6.19-r5 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.12-r2 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Chainguard | json-server | 0 | 0.17.4-r6 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.16.0-r12 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r17 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r20 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r20 |
| Chainguard | pelias-api | 0 | 7.6.0-r5 |
| Chainguard | thingsboard-tb-js-executor-fips | 0 | 4.3.1.1-r0 |
| Chainguard | thingsboard-tb-web-ui-fips | 0 | 4.3.1.1-r0 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.12-r2 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.3-r2 |
| Wolfi | json-server | 0 | 0.17.4-r6 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.16.0-r12 |
Related vulnerabilities
- CVE-2026-4867 Impact: A bad regular expression is generated any time you have three or more parameters… Same vulnerability
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects path-to-regexp
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects path-to-regexp
- CVE-2026-4923 Impact: When using multiple wildcards, combined with at least one parameter, a regular… Also affects path-to-regexp
- CVE-2026-4926 Impact: A bad regular expression is generated any time you have multiple sequential… Also affects path-to-regexp
- CVE-2024-52798 path-to-regexp turns path strings into a regular expressions. Also affects path-to-regexp
- CVE-2024-45296 path-to-regexp turns path strings into a regular expressions. Also affects path-to-regexp
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects argo-workflows-ui-3.6