npm / path-to-regexp
path-to-regexp
What changed in path-to-regexp 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
1 breaking2 security5 performance3 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpath-to-regexp 811 changes
Breaking changes 1
Limits generated combinations for optional route groups to fewer than 256, rejecting large combinations to avoid regex size explosions.
Security 2
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Restricts wildcard backtracking when a path uses more than one wildcard, addressing the listed security vulnerabilities.
Performance 5
Minimizes array allocations.
Reduces bundle size from 1.97 kB to 1.93 kB.
Improves compile performance by about 25%.
Removes internal tokenization during parse, which should improve parse performance by about 20%.
Deduplicates regex prefixes, resulting in shorter regular expressions for some cases using optional groups.
Fixes and other changes 3
Fixes an error caused by a trailing backslash.
Backtrack handling now allows a parameter to match itself, including matching the second underscore in
/foo__.Wildcards in non-ending mode no longer stop at the first match, avoiding truncated matches.