The vulnerability of the path-to-regexp transformation library arises from the inefficient computational complexity of regular expressions, allowing attackers to trigger a service failure.

🗓️ 09 Feb 2026 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The path-to-regexp vulnerability from inefficient regex complexity can overload and cause failure.

Reporter	Title	Published	Views	Family All 88
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-52798 path-to-regexp-0.1.10.tgz (Publicly disclosed vulnerability found by Mend) CVE-2024-52798	20 Feb 202506:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Python, Node.js, Golang Go, Linux kernel affect IBM Spectrum Protect Plus	10 Mar 202620:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	6 May 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to backtracking (CVE-2024-52798)	5 Mar 202516:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	12 Mar 202511:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java and Node.js	27 Jan 202514:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	4 Dec 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager.	15 Apr 202503:26	–	ibm

Vulners

Node

pillar.js path-to-regexpRange<0.1.12

Source	Link
security	www.security.netapp.com/advisory/ntap-20250124-0002/
lk	www.lk.astra.ru/
wiki	www.wiki.astralinux.ru/x/ziLoD
web	www.web.nvd.nist.gov/view/vuln/detail

09 Feb 2026 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.00792

path to regexp regex complexity service failure processor overload