Description
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters.
Recommendation
Update the path-to-regexp package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.1.13
- Patched version(s): 0.1.13
References
Could your website be exposed too?
SmartScanner can check your website for path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters and gives you actionable findings to investigate.
Start a free scanRelated Issues
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
- path-to-regexp vulnerable to Denial of Service via sequential optional groups - CVE-2026-4926
- angular vulnerable to regular expression denial of service via the <input type="url"> element - CVE-2023-26118
- angular vulnerable to regular expression denial of service via the $resource service - CVE-2023-26117
You might also like:
See something that needs correcting? Let us knowUpdated March 27, 2026