Packages / path-to-regexp / Security

ModerateVulnerabilityGHSA-27v5-c462-wpq7CVE-2026-4923Published 27 Mar 2026

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards

Your version

Affected releases · path-to-regexp

  • 8.x8.0.0 – 8.3.0Fixed in 8.4.0

On 8.x, the newest line:

npm install path-to-regexp@8.4.0
Every release on a timeline
9.x

  1. Not affected

    9.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.3.0

    4 releases

  2. Fixed

    8.4.0 – 8.4.2

    3 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

What happens

Impact

When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.

Unsafe examples:

/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y

Safe examples:

/*foo-:bar
/*foo-:bar-*baz

Patches

Upgrade to version 8.4.0.

Workarounds

If developers are using multiple wildcard parameters, they can check the regex output with a tool such as makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.