Description
A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b.
Recommendation
Update the path-to-regexp package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 6.3.0 >= 7.0.0, < 8.0.0 >= 2.0.0, < 3.3.0 >= 0.2.0, < 1.9.0 < 0.1.10** Patched version(s): **6.3.0 8.0.0 3.3.0 1.9.0 0.1.10**
References
Could your website be exposed too?
SmartScanner can check your website for path-to-regexp outputs backtracking regular expressions and gives you actionable findings to investigate.
Start a free scanRelated Issues
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
- path-to-regexp contains a ReDoS - CVE-2024-52798
- path-to-regexp vulnerable to Denial of Service via sequential optional groups - CVE-2026-4926
You might also like:
See something that needs correcting? Let us knowUpdated January 24, 2025