EUVD-2026-16324
GHSA-j3q9-mxjg-w52f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft route pattern with multiple sequential optional groups
-
ExploitTrigger exponential regex generation
-
ExecutionExhaust CPU resources
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can trigger DoS by defining route patterns with multiple sequential optional groups (curly brace syntax like {a}{b}{c}:z) in affected application versions before 8.4.0. No user interaction required. Requires ability to define or influence route patterns. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates this vulnerability is remotely exploitable without authentication or user interaction, with low attack complexity and high availability impact, yielding a score of 7.5. The availability-only impact (A:H) with no confidentiality or integrity consequences positions this as a service disruption threat rather than data breach risk. Real-world exploitation depends heavily on application architecture: systems that accept user-controlled input for route pattern definition face immediate risk, while applications with static, developer-defined routes have minimal exposure. No EPSS score, KEV listing, or public proof-of-concept was provided in the intelligence data, suggesting this has not yet been widely targeted. Given the narrow exploitation window (requires user-controlled route patterns, which is uncommon in production deployments) and availability of patches, this represents a moderate priority for systems running affected versions with dynamic routing, but low urgency for typical static-route implementations. |
| Exploit ScenarioDerived | An attacker identifies a Node.js application using vulnerable path-to-regexp versions that accepts route pattern definitions through an API or configuration endpoint. The attacker submits a crafted route pattern containing numerous sequential optional groups such as {a}{b}{c}{d}{e}{f}{g}{h}:endpoint, causing the library to generate an exponentially complex regular expression. When the application attempts to compile or match against this pattern, CPU utilization spikes to 100% and the event loop blocks, rendering the application unresponsive to legitimate requests and achieving denial of service without requiring authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The path-to-regexp library versions 8.0.0 through 8.3.0 suffer from catastrophic regular expression denial of service via exponential regex generation when route patterns contain multiple sequential optional groups in curly-brace syntax. Remote unauthenticated attackers can trigger resource exhaustion by submitting crafted route patterns, causing application-level denial of service with CVSS 7.5 (High severity). No public exploit identified at time of analysis, and the vendor has released version 8.4.0 to address the issue.
RemediationAI
Upgrade path-to-regexp to version 8.4.0 or later, which contains the vendor-released patch addressing the exponential regex generation issue. Organizations should review the OpenJS Foundation security advisory at https://cna.openjsf.org/security-advisories.html for complete upgrade guidance. As an interim mitigation until patching is completed, implement input validation to limit the number of sequential optional groups in route patterns and enforce strict controls preventing user-supplied data from being used as route pattern definitions. Applications using static route configurations defined at development time require less urgent remediation compared to systems dynamically generating routes from external input.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The path-to-regexp library, a widely-used JavaScript routing utility that converts path strings into regular expressions (affected product: cpe:2.3:a:path-to-regexp:path-to-regexp), contains a flaw rooted in CWE-400 (Uncontrolled Resource Consumption). When processing route patterns with multiple consecutive optional groups using curly-brace syntax such as {a}{b}{c}:z, the library generates regular expressions that grow exponentially in complexity with each additional group. This algorithmic inefficiency creates a classic Regular Expression Denial of Service (ReDoS) condition where pattern-matching operations consume excessive CPU cycles, potentially blocking the event loop in Node.js applications or causing significant performance degradation in environments where the library processes route definitions.
Know when Path To Regexp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2DescriptionCVE.org
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Blast Radius
ecosystem impact- 32 npm packages depend on path-to-regexp (12 direct, 20 indirect)
Ecosystem-wide dependent count for version 8.0.0.
Executive ViewAI
The path-to-regexp library (versions 8.0.0-8.3.0) contains a denial-of-service vulnerability that allows unauthenticated remote attackers to exhaust application resources through maliciously crafted route patterns, potentially disrupting web services that depend on this widely-used routing component. Organizations using affected versions face application downtime and service unavailability risks without mitigation.
Implement Web Application Firewall (WAF) rules to detect and block requests containing multiple sequential optional groups in curly-brace route syntax; apply network-level rate limiting on route pattern submissions; disable or restrict public-facing route configuration endpoints if feasible; monitor application resource utilization (CPU, memory) for anomalous spikes indicative of ReDoS attacks. These mitigations reduce but do not eliminate risk; patch deployment is required for full remediation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Path To Regexp
View allCatastrophic backtracking in path-to-regexp versions prior to 0.1.13 enables remote denial of service attacks through sp
path-to-regexp versions prior to 8.4.0 are vulnerable to Regular Expression Denial of Service (ReDoS) when processing mu
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 6.2.0-1 | - |
| bookworm | vulnerable | 6.2.1-1 | - |
| trixie | vulnerable | 6.3.0-1 | - |
| forky, sid | vulnerable | 8.3.0-1 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB