--- title: "GHSA-9wv6-86v2-598j: path-to-regexp outputs backtracking regular expressions" description: "High severity. path-to-regexp outputs backtracking regular expressions. Affects path-to-regexp; fixed in 8.0.0." url: https://inlinr.com/advisories/GHSA-9wv6-86v2-598j lang: en --- [Packages](https://inlinr.com/packages) / [path-to-regexp](https://inlinr.com/packages/path-to-regexp) / [Security](https://inlinr.com/packages/path-to-regexp/security) High Vulnerability GHSA-9wv6-86v2-598j CVE-2024-45296 CVE-2026-4867 GHSA-37ch-88jc-xwx2 Published 9 Sep 2024 # path-to-regexp outputs backtracking regular expressions Your version Affected releases · [path-to-regexp](https://inlinr.com/packages/path-to-regexp) - 7.x 7.0.0 – 7.2.0 No fix on this line yet - 6.x 6.0.0 – 6.2.2 Fixed in 6.3.0 - 5.x to 4.x 4.0.0 – 5.0.0 No fix, no longer updated - 3.x 3.0.0 – 3.2.0 Fixed in 3.3.0 - 2.x 2.0.0 – 2.4.0 No fix on this line yet - 1.x 1.0.0 – 1.8.0 Fixed in 1.9.0 - 0.2.x 0.2.0 – 0.2.5 No fix on this line yet - 0.1.x 0.1.0 – 0.1.9 Fixed in 0.1.10 - 0.0.x 0.0.1 – 0.0.2 No fix on this line yet 7.x has no fix yet; the newest fixed line: ``` npm install path-to-regexp@6.3.0 ``` Every release on a timeline 9.x 1. Not affected 9.0.0 1 release, latest 7.x 1. Affected 7.0.0 – 7.2.0 3 releases 6.x 1. Affected 6.0.0 – 6.2.2 5 releases 2. Fixed 6.3.0 1 release 5.x 1. Affected 5.0.0 1 release 4.x 1. Affected 4.0.0 – 4.0.5 6 releases 3.x 1. Affected 3.0.0 – 3.2.0 3 releases 2. Fixed 3.3.0 1 release 2.x 1. Affected 2.0.0 – 2.4.0 6 releases 1.x 1. Affected 1.0.0 – 1.8.0 17 releases 2. Fixed 1.9.0 1 release 0.x 1. Affected 0.0.1 – 0.1.9 12 releases 2. Fixed 0.1.10 – 0.1.13 4 releases 3. Affected 0.2.0 – 0.2.5 6 releases 74 stable releases of path-to-regexp, oldest to newest, one row per major. ## What happens Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`. Patches For users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`. These versions add backtrack protection when a custom regex pattern is not provided: - [0.1.10](https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10 "https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10") - [1.9.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0") - [3.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0") - [6.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0") They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version [7.1.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0") can enable `strict: true` and get an error when the regular expression might be bad. Version [8.0.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0") removes the features that can cause a ReDoS. Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b` to `/:a-:b([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. Details Using `/:a-:b` will produce the regular expression `/^\/([^\/]+?)-([^\/]+?)\/?$/`. This can be exploited by a path such as `/a${'-a'.repeat(8_000)}/a`. [OWASP](https://owasp.org/www-community/attacks/Regular%5Fexpression%5FDenial%5Fof%5FService%5F-%5FReDoS "https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS") has a good example of why this occurs, but the TL;DR is the `/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of \~600ms vs 1ms. References - [OWASP](https://owasp.org/www-community/attacks/Regular%5Fexpression%5FDenial%5Fof%5FService%5F-%5FReDoS "https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS") - [Detailed blog post](https://blakeembrey.com/posts/2024-09-web-redos/ "https://blakeembrey.com/posts/2024-09-web-redos/") ## How it is exploited Exploitable over the network, with no account and no action from a user. - **Confidentiality**: none - **Integrity**: none - **Availability**: high CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H ## References - [Reference](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j") github.com/pillarjs/path-to-regexp/security/adv… - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-45296 "https://nvd.nist.gov/vuln/detail/CVE-2024-45296") nvd.nist.gov/vuln/detail/CVE-2024-45296 - [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f") 29b96b4 - [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6 "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6") 60f2121 - [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485 "https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485") 925ac8e - [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef "https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef") d31670a - [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894 "https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894") f1253b4 - [Package](https://github.com/pillarjs/path-to-regexp "https://github.com/pillarjs/path-to-regexp") github.com/pillarjs/path-to-regexp - [Reference](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0 "https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0") github.com/pillarjs/path-to-regexp/releases/tag… - [Reference](https://security.netapp.com/advisory/ntap-20250124-0001 "https://security.netapp.com/advisory/ntap-20250124-0001") security.netapp.com/advisory/ntap-20250124-0001