diff --git a/commit-stream.js b/commit-stream.js
index 0f034b0..684a50c 100644
--- a/commit-stream.js
+++ b/commit-stream.js
@@ -46,7 +46,7 @@ export default function commitStream (ghUser, ghProject) {
         commit.reviewers = []
       }
       commit.reviewers.push({ name: m[1], email: m[2] })
-    } else if ((m = line.match(/\bCVE-ID:\s+(CVE-\d{4}-\d{5})\b/)) !== null) {
+    } else if ((m = line.match(/\bCVE-ID:\s+(CVE-\d{4}-\d{4,})\b/)) !== null) {
       commit.cveId = m[1];
     } else if ((m = line.match(/^\s+PR(?:[- ]?URL)?:?\s*(.+)\s*$/) || line.match(/\(#(\d+)\)$/)) !== null) {
       commit.prUrl = m[1]
diff --git a/test.js b/test.js
index ddd8439..cd24a0c 100644
--- a/test.js
+++ b/test.js
@@ -252,3 +252,27 @@ test('cve id', function (t) {
     }, 'got correct pr url for green-button merge')
   })
 })
+
+test('cve id with 4 or more sequence digits', function (t) {
+  const log = (cveId) => [
+    'commit 0000000000000000000000000000000000000000',
+    'Author: RafaelGSS <rafael.nunu@hotmail.com>',
+    'Date:   Fri Nov 22 00:19:29 2024 -0300',
+    '',
+    '    deps: fix vulnerability',
+    '',
+    `    CVE-ID: ${cveId}`
+  ]
+  const ids = ['CVE-2026-9358', 'CVE-2024-12345', 'CVE-2017-1000117']
+  const stream = commitStream()
+  const commits = []
+  stream.on('data', (commit) => commits.push(commit))
+  stream.on('end', () => {
+    t.deepEqual(commits.map((c) => c.cveId), ids)
+    t.end()
+  })
+  for (const id of ids) {
+    for (const line of log(id)) stream.write(line)
+  }
+  stream.end()
+})