Is path-to-regexp 8.0 vulnerable?
npm · 1 release from 8.0.0 to 8.0.0 · latest path-to-regexp is 9.0.0 · checked 1 Nov 2026
Yes: 2 known advisories
Yes. path-to-regexp 8.0.0, the last 8.0 release, is affected by 2 known security advisories (1 high, 1 medium), including CVE-2026-4926, CVE-2026-4923. Upgrade to 8.4.0 or later to fix all of them.
npm install path-to-regexp@8.4.0Advisories affecting path-to-regexp 8.0.0
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
- Affected
- >=8.0.0 <8.4.0
- Fixed in
- 8.4.0
path-to-regexp vulnerable to Denial of Service via sequential optional groups
- Affected
- >=8.0.0 <8.4.0
- Fixed in
- 8.4.0
Which of your client projects are still on path-to-regexp 8.0?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact path-to-regexp version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other path-to-regexp versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.