path-to-regexp
NPM Package
Vulnerability Check
Express style path to RegExp utility
path-to-regexp
Advisory Breakdown
Severity Rating
High severity5 advisories
High severity
Weekly downloads
181,960,777
Total advisories
5
Latest version
8.4.2
License
MIT
Known advisories
OSV records for the npm ecosystem
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
path-to-regexp outputs backtracking regular expressions
path-to-regexp vulnerable to Denial of Service via sequential optional groups
path-to-regexp contains a ReDoS
Checked Jun 14, 2026, 10:57 PM from npm and OSV.dev
Package metadata
From the npm registry
- Package name
- path-to-regexp
- Ecosystem
- npm
- Latest version
- 8.4.2
- License
- MIT
- Weekly downloads
- 181,960,777
- Repository
- Open repository
Remediation boundary
What RequestGuard does — and doesn't — cover
RequestGuard does not fix npm package vulnerabilities. Dependency remediation happens through package updates, patches, lockfile changes, and maintainer guidance. RequestGuard can help mitigate runtime abuse around exposed web and API flows while remediation is handled separately.
Data from npm registry and OSV.dev · Checked 6/14/2026, 10:57:10 PM