What’s Vulnerable › Products

path-to-regexp vulnerabilities

5 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your path-to-regexp version is affected

Latest path-to-regexp vulnerabilities

• CVE-2026-4926 — path-to-regexp vulnerable to Denial of Service via sequential optional groups (CVSS 7.5)
• CVE-2026-4923 — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards (CVSS 5.9)
• CVE-2026-4867 — path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters (CVSS 7.5)
• CVE-2024-52798 — path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x (CVSS 7.7)
• CVE-2024-45296 — path-to-regexp outputs backtracking regular expressions (CVSS 7.5)