---
title: "GHSA-rhx6-c78j-4q9w: path-to-regexp contains a ReDoS"
description: "High severity. path-to-regexp contains a ReDoS. Affects path-to-regexp; fixed in 0.1.12."
url: https://inlinr.com/advisories/GHSA-rhx6-c78j-4q9w
lang: en
---

[Packages](https://inlinr.com/packages) / [path-to-regexp](https://inlinr.com/packages/path-to-regexp) / [Security](https://inlinr.com/packages/path-to-regexp/security)

High Vulnerability GHSA-rhx6-c78j-4q9w CVE-2024-52798 Published 5 Dec 2024

# path-to-regexp contains a ReDoS

Your version 

Affected releases · [path-to-regexp](https://inlinr.com/packages/path-to-regexp)

- 0.1.x 0.1.0 – 0.1.11 Fixed in 0.1.12
- 0.0.x 0.0.1 – 0.0.2 No fix on this line yet

On 0.1.x, the newest line:

```
npm install path-to-regexp@0.1.12
```

Every release on a timeline

9.x 

1. Not affected

9.0.0  
1 release, latest

0.x 

1. Affected

0.0.1 – 0.1.11  
14 releases
2. Fixed

0.1.12 – 0.2.5  
8 releases

74 stable releases of path-to-regexp, oldest to newest, one row per major.

## What happens

Impact

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of `path-to-regexp`, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not `.` (e.g. no `/:a-:b`). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

References

- [github.com/advisories/GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j "https://github.com/advisories/GHSA-9wv6-86v2-598j")
- [blakeembrey.com/posts/2024-09-web-redos/](https://blakeembrey.com/posts/2024-09-web-redos/ "https://blakeembrey.com/posts/2024-09-web-redos/")

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w")  
github.com/pillarjs/path-to-regexp/security/adv…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-52798 "https://nvd.nist.gov/vuln/detail/CVE-2024-52798")  
nvd.nist.gov/vuln/detail/CVE-2024-52798
- [Fix commit](https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4 "https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4")  
f01c26a
- [Reference](https://blakeembrey.com/posts/2024-09-web-redos "https://blakeembrey.com/posts/2024-09-web-redos")  
blakeembrey.com/posts/2024-09-web-redos
- [Package](https://github.com/pillarjs/path-to-regexp "https://github.com/pillarjs/path-to-regexp")  
github.com/pillarjs/path-to-regexp
- [Reference](https://security.netapp.com/advisory/ntap-20250124-0002 "https://security.netapp.com/advisory/ntap-20250124-0002")  
security.netapp.com/advisory/ntap-20250124-0002