---
title: "path-to-regexp security advisories"
description: "5 known security advisories for path-to-regexp, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/path-to-regexp/security
lang: en
---

[Packages](https://inlinr.com/packages)

# path-to-regexp

9.0.0 · 22 Oct 2026 MIT 310.6M / week [Repository](https://github.com/pillarjs/path-to-regexp) [Homepage](https://github.com/pillarjs/path-to-regexp#readme) [npm](https://www.npmjs.com/package/path-to-regexp) [Atom feed](https://inlinr.com/packages/feed/path-to-regexp)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                           |
| ---- | ------ | ------------------------------------------------------------------------- |
|      | 9.0.0  | No known advisory                                                         |
|      | 8.4.2  | Safe from 8.4.0                                                           |
|      | 7.2.0  | 5 open advisories, worst high  · last release Sep 2024, no longer updated |
|      | 0.1.13 | Safe from 0.1.13                                                          |
|      | 0.0.2  | 3 open advisories, worst high  · last release Feb 2013, no longer updated |

- High  
[path-to-regexp vulnerable to Denial of Service via sequential optional groups](https://inlinr.com/advisories/GHSA-j3q9-mxjg-w52f)GHSA-j3q9-mxjg-w52f · 27 Mar 2026  
fixed in 8.4.0
- High  
[path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters](https://inlinr.com/advisories/GHSA-37ch-88jc-xwx2)GHSA-37ch-88jc-xwx2 · 27 Mar 2026  
fixed in 0.1.13
- High  
[path-to-regexp contains a ReDoS](https://inlinr.com/advisories/GHSA-rhx6-c78j-4q9w)GHSA-rhx6-c78j-4q9w · 5 Dec 2024  
fixed in 0.1.12
- High  
[path-to-regexp outputs backtracking regular expressions](https://inlinr.com/advisories/GHSA-9wv6-86v2-598j)GHSA-9wv6-86v2-598j · 9 Sep 2024  
fixed in 6.3.0, 3.3.0, 1.9.0 +1
- Moderate  
[path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards](https://inlinr.com/advisories/GHSA-27v5-c462-wpq7)GHSA-27v5-c462-wpq7 · 27 Mar 2026  
fixed in 8.4.0

### Quality and security signals

What [npm](https://www.npmjs.com/package/path-to-regexp) and [deps.dev](https://deps.dev/npm/path-to-regexp) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Reading releases, release notes and advisories…

Registry facts last checked 3 Nov 2026\. Releases and advisories last read 3 Nov 2026.