Packages / path-to-regexp / Security

HighVulnerabilityGHSA-rhx6-c78j-4q9wCVE-2024-52798Published 5 Dec 2024

path-to-regexp contains a ReDoS

Your version

Affected releases · path-to-regexp

  • 0.1.x0.1.0 – 0.1.11Fixed in 0.1.12
  • 0.0.x0.0.1 – 0.0.2No fix on this line yet

On 0.1.x, the newest line:

npm install path-to-regexp@0.1.12
Every release on a timeline
9.x

  1. Not affected

    9.0.0

    1 release, latest

0.x

  1. Affected

    0.0.1 – 0.1.11

    14 releases

  2. Fixed

    0.1.12 – 0.2.5

    8 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

What happens

Impact

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

References