---
title: "GHSA-37ch-88jc-xwx2: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters"
description: "High severity. path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters. Affects path-to-regexp; fixed in 0.1.13."
url: https://inlinr.com/advisories/GHSA-37ch-88jc-xwx2
lang: en
---

[Packages](https://inlinr.com/packages) / [path-to-regexp](https://inlinr.com/packages/path-to-regexp) / [Security](https://inlinr.com/packages/path-to-regexp/security)

High Vulnerability GHSA-37ch-88jc-xwx2 CVE-2024-45296 CVE-2026-4867 GHSA-9wv6-86v2-598j Published 27 Mar 2026

# path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

Your version 

Affected releases · [path-to-regexp](https://inlinr.com/packages/path-to-regexp)

- 0.1.x 0.1.0 – 0.1.12 Fixed in 0.1.13
- 0.0.x 0.0.1 – 0.0.2 No fix on this line yet

On 0.1.x, the newest line:

```
npm install path-to-regexp@0.1.13
```

Every release on a timeline

9.x 

1. Not affected

9.0.0  
1 release, latest

0.x 

1. Affected

0.0.1 – 0.1.12  
15 releases
2. Fixed

0.1.13 – 0.2.5  
7 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

## What happens

Impact

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection added in `path-to-regexp@0.1.12` only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.

Patches

Upgrade to [path-to-regexp@0.1.13](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13 "https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13")

Custom regex patterns in route definitions (e.g., `/:a-:b([^-/]+)-:c([^-/]+)`) are not affected because they override the default capture group.

Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`.

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

References

- [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j "https://github.com/advisories/GHSA-9wv6-86v2-598j")
- [Detailed blog post: ReDoS the web](https://blakeembrey.com/posts/2024-09-web-redos/ "https://blakeembrey.com/posts/2024-09-web-redos/")

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2 "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2")  
github.com/pillarjs/path-to-regexp/security/adv…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-4867 "https://nvd.nist.gov/vuln/detail/CVE-2026-4867")  
nvd.nist.gov/vuln/detail/CVE-2026-4867
- [Reference](https://blakeembrey.com/posts/2024-09-web-redos "https://blakeembrey.com/posts/2024-09-web-redos")  
blakeembrey.com/posts/2024-09-web-redos
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [GitHub advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j "https://github.com/advisories/GHSA-9wv6-86v2-598j")  
github.com/advisories/GHSA-9wv6-86v2-598j
- [Package](https://github.com/pillarjs/path-to-regexp "https://github.com/pillarjs/path-to-regexp")  
github.com/pillarjs/path-to-regexp
- [Reference](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13 "https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13")  
github.com/pillarjs/path-to-regexp/releases/tag…