Important: This release switches the package to ESM only and node >= 22. The primary incompatible API change is to switch ambiguous matches (2+ parameters in a segment) from the first being greedy to the last. For example:

const input = "/foo.json.html";
const fn = match("/:file.:ext");

fn(input); //=> ["foo", "json.html"]

In the v8 this would have output ["foo.json", "html"]. Making the last parameter and wildcard greedy can improve performance of the regular expressions and makes it easier to build non-regex based versions of the matcher.

Changed

• Avoid duplicate trailing delimiter matches by @vibhor-aggr in #443
  • A path that explicitly provided the trailing delimiter (e.g. /foo/) will no longer append an extra optional delimiter
• Refactor matching to be non-greedy by @blakeembrey in #450
• Build project as ESM by @blakeembrey in #458
• Remove TokenData class and Keys type by @blakeembrey in #461

Fixed

• Reject an empty-string param in compile by @spokodev in #444
• Reject wildcard array that compiles to an empty path by @spokodev in #448
• Fix stringify of param names with control characters by @chatman-media in #445
• Quote param names followed by astral ID_Continue text by @dylanpulver in #451
• Fix stringify lookahead across empty text tokens by @jakezwang in #456

Full Changelog: v8.4.2...v9.0.0

Fixed

• Error on trailing backslash (#434) 9a78879

Performance

• Minimize array allocations (#437) 937c02d
• Improve compile performance (#436) 57247e6
  • Should improve compilation performance by ~25%
• Remove internal tokenization during parse (#435) 5844988
  • Should improve parse performance by ~20%

Bundle size to 1.93 kB, from 1.97 kB.

v8.4.1...v8.4.2

Fixed

• Remove trie deduplication (#431) 6bc8e84
  • Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example:
    • /*foo with /a/b = /a
    • /*foo.htmlwith /a/b.html/c.html = /a/b.html
• Allow backtrack handling to match itself (#427) 5bcd30b
  • When backtracking was introduced, it rejected matching things like /:"a"_:"b" against /foo__. This makes intuitive sense because the second parameter is not going to backtrack on _ anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second _.

v8.4.0...v8.4.1

Important

• Fix CVE-2026-4926 (GHSA-j3q9-mxjg-w52f)
• Fix CVE-2026-4923 (GHSA-27v5-c462-wpq7)

Fixed

• Restricts wildcard backtracking when using more than 1 in a path (#421)

Changed

• Dedupes regex prefixes (#422)
  • This will result in shorter regular expressions for some cases using optional groups
• Rejects large optional route combinations (#424)
  • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

Important

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: v0.1.12...v.0.1.13

Changed

• Add custom error class (#398) 2a7f2a4
• Allow plain objects for TokenData (#391) 687a9bb
• Escape text should escape backslash (#390) a4a8552
• Improved error messages and stack size (#363) a6bdf40

Other

• Minifying the parser
  • PR (#401) 9df2448
  • PR (#395) 4a91505
  • Shaving some bytes d63f44b
  • Remove optional operator 973d15c

v8.2.0...v8.3.0

Fixed

• Improved backtracking protection for 0.1.x, will break some previously valid paths (see previous advisory: GHSA-9wv6-86v2-598j)

v0.1.11...v0.1.12

Fixed

• Allowing path-to-regexp to run on older browsers by targeting ES2015
  • Target ES2015 5969033
    • Also saved 0.22kb (10%!) by removing the private class field down level
  • Remove s flag from regexp 51dbd45

v8.1.0...v8.2.0

Fixed

• Add backtrack protection to 6.x (#324) f1253b4

v6.2.2...v6.3.0

Changed

• Add error on bad input values 8f09549

v0.1.10...v0.1.11