path-to-regexp outputs backtracking regular expressions

Description

A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b.

Recommendation

Update the path-to-regexp package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0, < 6.3.0

  >= 7.0.0, < 8.0.0

  >= 2.0.0, < 3.3.0

  >= 0.2.0, < 1.9.0

  < 0.1.10**

• Patched version(s): **6.3.0

  8.0.0

  3.3.0

  1.9.0

  0.1.10**

References

• GHSA-9wv6-86v2-598j
• security.netapp.com
• CVE-2024-45296
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• path-to-regexp contains a ReDoS - CVE-2024-52798
• path-to-regexp vulnerable to Denial of Service via sequential optional groups - CVE-2026-4926

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

path-to-regexp