Description Preview
path-to-regexp converts path strings into regular expressions. In certain cases, it can generate a regular expression that is highly susceptible to inefficient backtracking, leading to poor performance. Specifically, a problematic regex is produced when there are two parameters within a single path segment separated by a character that is not a period. Since JavaScript runs regex matching on the main thread, such backtracking-heavy expressions can block the event loop and cause a denial of service. The advisory notes that users on the 0.1 line should upgrade to 0.1.10, and all other users should upgrade to 8.0.0 or newer. The issue does not expose data but can render servers unresponsive under certain inputs.
Overview
The vulnerability stems from path-to-regexp generating backtracking-prone regular expressions when converting certain path patterns into regexes. In environments where JavaScript runs on a single thread, lengthy or nested backtracking during regex evaluation can exhaust CPU time and block the event loop, resulting in a denial of service. Affected versions include < 0.1.10 and >= 0.2.0, < 8.0.0. Upgrading to 0.1.10 or to 8.0.0 (or newer) mitigates the risk. The issue is triggered by specific path segment patterns involving two parameters separated by non-period characters.
Remediation
- Upgrade to fixed versions:
- If you rely on the 0.x 0.1 line: upgrade to 0.1.10.
- If you are on 0.2.x through 7.x: upgrade to 8.0.0 or newer.
- Implement upgrade in your package manager:
- npm: npm install path-to-regexp@^0.1.10 (for the 0.1 line) or npm install path-to-regexp@^8.0.0 (for 0.2.x+ line), then run npm install to refresh the lockfile.
- yarn or pnpm: adjust the version constraints accordingly and reinstall.
- Verify and test:
- Run npm ls path-to-regexp to confirm the patched version is in use.
- Run full regression tests and monitor for performance or functional issues.
- Additional guidance:
- Review your dependency tree for indirect usages of vulnerable path-to-regexp versions and update transitive dependencies as needed.
- After upgrading, monitor for any performance regressions and consider running targeted DoS/load tests to confirm the mitigation.
References
- GHSA-9wv6-86v2-598j: https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
- Commit fixing the issue: https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
- Additional fix/related change: https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
- NetApp advisory entry: https://security.netapp.com/advisory/ntap-20250124-0001/
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing: Medium
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services: Low
- Public AdministrationPublic Administration: Low
- Finance and InsuranceFinance and Insurance: Low
- Health Care & Social AssistanceHealth Care & Social Assistance: Low
- Retail TradeRetail Trade: Low
- Arts, Entertainment & RecreationArts, Entertainment & Recreation: Low
- Management of Companies & EnterprisesManagement of Companies & Enterprises: Low
- Real Estate Rental & LeasingReal Estate Rental & Leasing: Low
- Transportation & WarehousingTransportation & Warehousing: Low
- Educational ServicesEducational Services: Low
- Other Services (except Public Administration)Other Services (except Public Administration): Low
- Accommodation & Food ServicesAccommodation & Food Services: Low
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services: Low
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting: Low
- ConstructionConstruction: Low
- InformationInformation: Low
- MiningMining: Low
- UtilitiesUtilities: Low
- Wholesale TradeWholesale Trade: Low

