# What changed in path-to-regexp

> 11 changes in path-to-regexp 8 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/path-to-regexp/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## path-to-regexp 8

### Breaking changes

- Limits generated combinations for optional route groups to fewer than 256, rejecting large combinations to avoid regex size explosions. (8.4.0) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.0)

### Security

- path-to-regexp vulnerable to Denial of Service via sequential optional groups (8.4.0) — [security advisory](https://github.com/advisories/GHSA-J3Q9-MXJG-W52F)
- Restricts wildcard backtracking when a path uses more than one wildcard, addressing the listed security vulnerabilities. (8.4.0) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.0), [security advisory](https://github.com/advisories/GHSA-27V5-C462-WPQ7)

### Performance

- Minimizes array allocations. (8.4.2) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2)
- Reduces bundle size from 1.97 kB to 1.93 kB. (8.4.2) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2)
- Improves compile performance by about 25%. (8.4.2) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2)
- Removes internal tokenization during parse, which should improve parse performance by about 20%. (8.4.2) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2)
- Deduplicates regex prefixes, resulting in shorter regular expressions for some cases using optional groups. (8.4.0) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.0)

### Fixes and other changes

- Fixes an error caused by a trailing backslash. (8.4.2) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2)
- Backtrack handling now allows a parameter to match itself, including matching the second underscore in `/foo__`. (8.4.1) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.1)
- Wildcards in non-ending mode no longer stop at the first match, avoiding truncated matches. (8.4.1) — [release notes](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.1)