Path-to-regexp vulnerabilities
We track 2 vulnerabilities in Path-to-regexp products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on March 26, 2026.
2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score
Latest Path-to-regexp vulnerabilities
- 7.5 High severity
path-to-regexp: Uncontrolled Resource Consumption
Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ver
- 7.5 High severity
path-to-regexp: Inefficient Regular Expression Complexity
Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] o