path-to-regexp
9.0.0 · 22 Oct 2026MIT310.6M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 9.0.0 | No known advisory | |
| 8.4.2 | Safe from 8.4.0 | |
| 7.2.0 | 5 open advisories, worst high · last release Sep 2024, no longer updated | |
| 0.1.13 | Safe from 0.1.13 | |
| 0.0.2 | 3 open advisories, worst high · last release Feb 2013, no longer updated |
- Highpath-to-regexp vulnerable to Denial of Service via sequential optional groupsGHSA-j3q9-mxjg-w52f · 27 Mar 2026fixed in 8.4.0
- Highpath-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersGHSA-37ch-88jc-xwx2 · 27 Mar 2026fixed in 0.1.13
- Highpath-to-regexp contains a ReDoSGHSA-rhx6-c78j-4q9w · 5 Dec 2024fixed in 0.1.12
- Highpath-to-regexp outputs backtracking regular expressionsGHSA-9wv6-86v2-598j · 9 Sep 2024fixed in 6.3.0, 3.3.0, 1.9.0 +1
- Moderatepath-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcardsGHSA-27v5-c462-wpq7 · 27 Mar 2026fixed in 8.4.0
Reading releases, release notes and advisories…
Registry facts last checked 3 Nov 2026. Releases and advisories last read 3 Nov 2026.