High · published March 26, 2026
Impact:
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches:
Fixed in version 8.4.0.
Workarounds:
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
| Product | Versions | Fixed in |
|---|---|---|
| pillarjs/path-to-regexp | ≥ 8.0.0, < 8.4.0 | 8.4.0 |