A misuse of the regular expression engine in the path-to-regexp library causes a denial of service when route patterns contain multiple sequential optional groups. The algorithm that transforms these patterns into a regular expression expands exponentially as more optional groups are added, which can overload the server with time to compile or match the pattern. This weakness reduces the availability of applications that rely on path-to-regexp for routing.

The vulnerability affects the path-to-regexp package, a JavaScript routing utility used in many web frameworks. Any deployment using a version prior to 8.4.0 is susceptible, especially when route definitions include more than one consecutive optional group. Products that embed path-to-regexp directly or indirectly must verify the version they are running.

With a CVSS score of 7.5 the risk is moderate to high. Exploitation requires crafting a route pattern with sequential optional groups, which is feasible if the application author uses dynamic route construction from user input. Attackers can trigger CPU exhaustion by repeatedly accessing such URLs, leading to denial of service. Because the EPSS score is unavailable, the probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog, but the severity remains significant for exposed applications.