Skip to content
OpenAdvisories

Package · Debian

node-path-to-regexp

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-4926

    path-to-regexp vulnerable to Denial of Service via sequential optional groups

    Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ve…

    path-to-regexp path-to-regexp path-to-regexp node-path-to-regexp Debian npm
  • High 7.5
    CVE-2026-4867

    path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

    Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 …

    path-to-regexp path-to-regexp node-path-to-regexp Debian
  • High 7.5
    CVE-2024-45296

    path-to-regexp outputs backtracking regular expressions

    path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …

    pillarjs path-to-regexp node-express path-to-regexp Debian Ubuntu npm