EUVD-2026-16273
GHSA-37ch-88jc-xwx2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft route with three+ parameters separated by non-period
-
ExploitRequest URL matching vulnerable pattern
-
ExecutionTrigger catastrophic backtracking in regex engine
-
ImpactCause denial of service through CPU exhaustion
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can trigger catastrophic backtracking via HTTP requests to routes with three or more parameters in a single segment separated by non-period characters (e.g., /:a-:b-:c) in path-to-regexp versions prior to 0.1.13. Default configurations affected; custom regex patterns exempt. |
| Impact | The CVSS v3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a high-severity network-accessible denial of service requiring no authentication or user interaction. SSVC analysis confirms the attack is automatable with partial technical impact, though exploitation status is listed as none. The vulnerability presents genuine operational risk for public-facing applications using vulnerable versions, as attackers can trigger service degradation with minimal effort by sending malicious URLs. However, the impact is limited to availability without data compromise or system access. The targeted nature of the vulnerability (requiring specific multi-parameter route patterns) may reduce exposure in practice, though many routing implementations use such patterns. No active exploitation is documented (not in CISA KEV) and no public exploit is identified at time of analysis, suggesting lower immediate urgency compared to actively exploited vulnerabilities, but the automatable nature and low complexity warrant prioritization for internet-facing services. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies an application using path-to-regexp with routes containing three or more parameters in a single segment (e.g., /api/:resource-:action-:id). The attacker crafts HTTP requests with URLs containing carefully constructed strings that maximize backtracking in the regex engine, such as long sequences of the separator character followed by the terminator. Multiple concurrent requests cause the server's CPU to spike as regex processing enters catastrophic backtracking, exhausting computational resources and rendering the application unresponsive to legitimate users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Catastrophic backtracking in path-to-regexp versions prior to 0.1.13 enables remote denial of service attacks through specially crafted URLs containing three or more parameters within a single route segment separated by non-period characters. The vulnerability stems from insufficient backtrack protection in regex generation for routes like /:a-:b-:c, allowing unauthenticated attackers to trigger exponential computation times. SSVC framework confirms the vulnerability is automatable with partial technical impact, though no public exploit is identified at time of analysis.
RemediationAI
Upgrade path-to-regexp to version 0.1.13 or later, which includes proper backtrack protection for multi-parameter route segments (vendor-released patch: 0.1.13). Consult the OpenJS Foundation security advisory at https://cna.openjsf.org/security-advisories.html and GitHub advisory at https://github.com/advisories/GHSA-9wv6-86v2-598j for implementation guidance. For environments where immediate upgrade is not feasible, apply custom regular expressions to parameters after the first in multi-parameter segments, ensuring the custom regex does not match text before the parameter (e.g., change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+)). Routes using custom regex patterns in their definitions are not affected and require no changes. As an additional compensating control, implement URL length restrictions at the web server or application gateway level to limit potential backtracking depth. Detailed technical explanation and workaround examples are available at https://blakeembrey.com/posts/2024-09-web-redos.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The path-to-regexp library (CPE: cpe:2.3:a:path-to-regexp:path-to-regexp) is a widely-used JavaScript utility for converting path strings into regular expressions, commonly employed in routing frameworks like Express.js. This vulnerability represents CWE-1333 (Inefficient Regular Expression Complexity), specifically a Regular Expression Denial of Service (ReDoS) condition. The backtrack protection mechanism introduced in version 0.1.12 only safeguarded against ambiguity in two-parameter segments. When three or more parameters exist in a single segment (e.g., /:a-:b-:c-:d), the generated lookahead assertion fails to block single separator characters, causing capture groups to overlap and triggering catastrophic backtracking where regex engine execution time grows exponentially with input length.
Know when Path To Regexp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Impact:
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.
Patches:
Upgrade to path-to-regexp@0.1.13
Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.
Workarounds:
All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).
If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Executive ViewAI
path-to-regexp versions prior to 0.1.13 contain a denial of service vulnerability affecting any application using this library for URL routing. Unauthenticated attackers can craft malicious URLs to exhaust server resources and disrupt service availability, with no patch currently available to remediate the risk.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Deploy Web Application Firewall rules to detect and block malformed multi-parameter route requests (e.g., URL patterns matching /:a-:b-:c syntax); (2) Implement strict request timeouts and connection limits to prevent resource exhaustion; (3) Apply network-level rate limiting on affected endpoints; (4) Consider disabling or restricting dynamic routing features until patch availability; (5) Monitor CPU and memory metrics for anomalous spikes indicating exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Path To Regexp
View allThe path-to-regexp library versions 8.0.0 through 8.3.0 suffer from catastrophic regular expression denial of service vi
path-to-regexp versions prior to 8.4.0 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing mu
Same technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 6.2.0-1 | - |
| bookworm | vulnerable | 6.2.1-1 | - |
| trixie | vulnerable | 6.3.0-1 | - |
| forky, sid | vulnerable | 8.3.0-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB