Packages / path-to-regexp / Security

HighVulnerabilityGHSA-j3q9-mxjg-w52fCVE-2026-4926Published 27 Mar 2026

path-to-regexp vulnerable to Denial of Service via sequential optional groups

Your version

Affected releases · path-to-regexp

  • 8.x8.0.0 – 8.3.0Fixed in 8.4.0

On 8.x, the newest line:

npm install path-to-regexp@8.4.0
Every release on a timeline
9.x

  1. Not affected

    9.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.3.0

    4 releases

  2. Fixed

    8.4.0 – 8.4.2

    3 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

What happens

Impact

A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.

Patches

Fixed in version 8.4.0.

Workarounds

Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.