npm package
path-to-regexp vulnerabilities by version
The latest release, 8.4.2 (Apr 1, 2026), has no known vulnerabilities. 24% of last week’s 236.2M downloads went to versions with known vulnerabilities. OSV.dev lists 4 advisories for path-to-regexp; the newest was published on Mar 27, 2026.
npm (opens in a new tab) describes it as “Express style path to RegExp utility”
- Latest release
- 8.4.2
- Apr 1, 2026, no known vulnerabilities
- Downloads last week
- 236.2M
- All versions, from npm
- Advisories on OSV.dev
- 4
- Newest Mar 27, 2026
- Licence
- MIT
Most-downloaded versions last week
From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.
Who is still on a vulnerable path-to-regexp
24% of last week’s 236.2M path-to-regexp downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Release lines
The newest release of each major line, from the registry. path-to-regexp doesn’t publish support dates we can check.
Newest advisories
The 4 most recently published, with the versions each one affects.
WarningCVE-2026-4923 on OSV.dev (opens in a new tab)GHSA-27v5-c462-wpq7
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Affects >= 8.0.0, < 8.4.0. Published Mar 27, 2026.
CriticalCVE-2026-4926 on OSV.dev (opens in a new tab)GHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Affects >= 8.0.0, < 8.4.0. Published Mar 27, 2026.
CriticalCVE-2024-45296 on OSV.dev (opens in a new tab)CVE-2026-4867
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Affects < 0.1.13. Published Mar 27, 2026.
CriticalCVE-2024-52798 on OSV.dev (opens in a new tab)GHSA-rhx6-c78j-4q9w
path-to-regexp contains a ReDoS
Affects < 0.1.12. Published Dec 5, 2024.
Which path-to-regexp do you have?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.
How this page is checked
StackPrism reads every OSV.dev advisory for path-to-regexp, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.