Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

path-to-regexp library could let attackers run code

published 3 months ago
Summary

The JavaScript library path-to-regexp, used in many web applications, has two security weaknesses that could allow an attacker to execute unauthorized code through crafted input. These issues are fixed in version 0.1.3-tuxcare.1. Update the library to this version as soon as possible to protect your applications.

What to do
  • Update blakeembrey path-to-regexp to version 0.1.3-tuxcare.1.
Affected software
Ecosystem VendorProductAffected versions
TuxCare:npm blakeembrey path-to-regexp < 0.1.3-tuxcare.1
Fix: upgrade to 0.1.3-tuxcare.1
Original advisory text
TuxCare security update for path-to-regexp (2 CVEs)
TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.3-tuxcare.1.
Timeline
Published4 Aug 2026
Updated15 Sep 2026
First seen15 Sep 2026
Sources
CLSA-2026-1773360981 · OSV
Track software like this
Free during beta