Is path-to-regexp 0.0 vulnerable?
npm · 2 releases from 0.0.1 to 0.0.2 · latest path-to-regexp is 9.0.0 · checked 2 Nov 2026
Yes: 3 known advisories
Yes. path-to-regexp 0.0.2, the last 0.0 release, is affected by 3 known security advisories (3 high), including CVE-2024-45296, CVE-2024-52798, CVE-2024-45296. Upgrade to 0.1.13 or later to fix all of them.
npm install path-to-regexp@0.1.13Advisories affecting path-to-regexp 0.0.2
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
- Affected
- <0.1.13
- Fixed in
- 0.1.13
path-to-regexp contains a ReDoS
- Affected
- <0.1.12
- Fixed in
- 0.1.12
path-to-regexp outputs backtracking regular expressions
- Affected
- >=0.2.0 <1.9.0 · <0.1.10 · >=7.0.0 <8.0.0 · >=2.0.0 <3.3.0 · >=4.0.0 <6.3.0
- Fixed in
- 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0
Which of your client projects are still on path-to-regexp 0.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact path-to-regexp version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other path-to-regexp versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.