Fixed

• Error on trailing backslash (#434) 9a78879

Performance

• Minimize array allocations (#437) 937c02d
• Improve compile performance (#436) 57247e6
  • Should improve compilation performance by ~25%
• Remove internal tokenization during parse (#435) 5844988
  • Should improve parse performance by ~20%

Bundle size to 1.93 kB, from 1.97 kB.

v8.4.1...v8.4.2

Fixed

• Remove trie deduplication (#431) 6bc8e84
  • Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example:
    • /*foo with /a/b = /a
    • /*foo.htmlwith /a/b.html/c.html = /a/b.html
• Allow backtrack handling to match itself (#427) 5bcd30b
  • When backtracking was introduced, it rejected matching things like /:"a"_:"b" against /foo__. This makes intuitive sense because the second parameter is not going to backtrack on _ anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second _.

v8.4.0...v8.4.1

Important

• Fix CVE-2026-4926 (GHSA-j3q9-mxjg-w52f)
• Fix CVE-2026-4923 (GHSA-27v5-c462-wpq7)

Fixed

• Restricts wildcard backtracking when using more than 1 in a path (#421)

Changed

• Dedupes regex prefixes (#422)
  • This will result in shorter regular expressions for some cases using optional groups
• Rejects large optional route combinations (#424)
  • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

Important

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: v0.1.12...v.0.1.13

Changed

• Add custom error class (#398) 2a7f2a4
• Allow plain objects for TokenData (#391) 687a9bb
• Escape text should escape backslash (#390) a4a8552
• Improved error messages and stack size (#363) a6bdf40

Other

• Minifying the parser
  • PR (#401) 9df2448
  • PR (#395) 4a91505
  • Shaving some bytes d63f44b
  • Remove optional operator 973d15c

v8.2.0...v8.3.0

Fixed

• Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)

v0.1.11...v0.1.12

Fixed

• Allowing path-to-regexp to run on older browsers by targeting ES2015
  • Target ES2015 5969033
    • Also saved 0.22kb (10%!) by removing the private class field down level
  • Remove s flag from regexp 51dbd45

v8.1.0...v8.2.0

Fixed

• Add backtrack protection to 6.x (#324) f1253b4

v6.2.2...v6.3.0

Changed

• Add error on bad input values 8f09549

v0.1.10...v0.1.11

Added

• Adds pathToRegexp method back for generating a regex
• Adds stringify method for converting TokenData into a path string

v8.0.0...v8.1.0