A high-severity regular expression complexity vulnerability in the path-to-regexp library allows unauthenticated remote attackers to trigger a denial-of-service condition via catastrophic backtracking.

This vulnerability is caused by inefficient regular expression complexity (CWE-1333) where the library fails to properly handle three or more parameters within a single path segment. An unauthenticated attacker can supply a specially crafted input string that causes the regular expression engine to enter an infinite loop, resulting in a denial-of-service.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to the ease of exploitation and the potential for complete service disruption. Successful exploitation results in the exhaustion of CPU resources, leading to system instability or total downtime for applications relying on this library for routing. This poses a significant risk to the availability of critical web services and business operations.

Immediate Action: Update the path-to-regexp dependency to version 0.1.13, 1.9.0, or 8.0.0 to incorporate the necessary backtracking protection.

Proactive Monitoring: Monitor server CPU utilization and error logs for spikes or unusual patterns that correlate with incoming HTTP requests, which may indicate attempted exploitation.

Compensating Controls: Implement input length validation or request rate limiting at the Web Application Firewall (WAF) or load balancer level to restrict the size and complexity of incoming URL segments.

Public Exploit Available: No confirmed public exploit (weaponized or otherwise) exists in the provided data.

Given the high CVSS score and the potential for service disruption, organizations using path-to-regexp must prioritize updating their dependencies immediately. If an immediate update is not feasible, apply the recommended workarounds, such as restricting URL lengths or defining custom regular expressions for route parameters, to prevent the triggering of the vulnerable code path.