The vulnerability allows an attacker to trigger a regular expression backtracking condition by crafting a path that contains multiple wildcards together with at least one parameter. The resulting regular expression can consume excessive CPU resources, leading to a denial of service for the application without providing any other direct compromise. The weakness is classified as Date Regular Expression Denial of Service (CWE-1333).

The affected component is the path-to-regexp library, an npm package used for routing in JavaScript applications. All versions before the 8.4.0 release are vulnerable. The library is commonly embedded in web frameworks that build request routing patterns, so any application that includes a vulnerable version of path-to-regexp is at risk.

The CVSS score of 5.9 indicates a medium severity impact. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, implying no publicly known exploits yet. The likely attack vector is an HTTP request containing a specially crafted URL that triggers the inefficient regular expression during routing. Because the vulnerability only affects internal pattern matching, remediation typically involves updating the dependency or avoiding multiple wildcard parameters in routes.