---
title: "path-to-regexp 9.0.0"
description: "Latest published version of path-to-regexp is 9.0.0, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/path-to-regexp
lang: en
---

[Packages](https://inlinr.com/packages)

# path-to-regexp

9.0.0 · 22 Oct 2026 MIT 310.6M / week [Repository](https://github.com/pillarjs/path-to-regexp) [Homepage](https://github.com/pillarjs/path-to-regexp#readme) [npm](https://www.npmjs.com/package/path-to-regexp) [Atom feed](https://inlinr.com/packages/feed/path-to-regexp)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/path-to-regexp/upgrade)

LineNewestSecurity

- 9.x 9.0.0 No known advisory Latest line
- 8.x 8.4.2 Safe from 8.4.0 [To 9.0.0](https://inlinr.com/packages/path-to-regexp/upgrade/8.4.2-9.0.0)
- 7.x and older 7.2.0 5 open advisories, worst high  · last release Sep 2024, no longer updated [To 9.0.0](https://inlinr.com/packages/path-to-regexp/upgrade/7.2.0-9.0.0)

## Latest releases

[All 74 releases](https://inlinr.com/packages/path-to-regexp/releases)

1. 9.x · latest line
2. ### [9.0.0](https://inlinr.com/packages/path-to-regexp/releases/9.0.0 "Open this release") [](https://github.com/pillarjs/path-to-regexp/releases/tag/v9.0.0 "Read this release where it was published")  
22 Oct 2026

  - Avoid duplicate trailing delimiter matches
  - Refactor matching to be non-greedy
  - Build project as ESM
3. 8.x · maintenance
4. ### [8.4.2](https://inlinr.com/packages/path-to-regexp/releases/8.4.2 "Open this release")  
1 Apr 2026
5. ### [8.4.1](https://inlinr.com/packages/path-to-regexp/releases/8.4.1 "Open this release")  
30 Mar 2026

Notes older than 90 days are read on the [Releases tab](https://inlinr.com/packages/path-to-regexp/releases).

Dependency tracking · free for 3 projects

## Know when your own dependencies move

path-to-regexp had 3 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[All 5](https://inlinr.com/packages/path-to-regexp/security)

- [path-to-regexp vulnerable to Denial of Service via sequential optional groups](https://inlinr.com/advisories/GHSA-j3q9-mxjg-w52f) High · fixed in 8.4.0
- [path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters](https://inlinr.com/advisories/GHSA-37ch-88jc-xwx2) High · fixed in 0.1.13
- [path-to-regexp contains a ReDoS](https://inlinr.com/advisories/GHSA-rhx6-c78j-4q9w) High · fixed in 0.1.12

## Health

[Details](https://inlinr.com/packages/path-to-regexp/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Reading releases, release notes and advisories…

Registry facts last checked 3 Nov 2026\. Releases and advisories last read 3 Nov 2026.