Packages / find-my-way / Security

HighVulnerabilityGHSA-rrr8-f88r-h8q6CVE-2024-45813Published 18 Sep 2024

find-my-way has a ReDoS vulnerability in multiparametric routes

Your version

Affected releases · find-my-way

  • 9.x9.0.0Fixed in 9.0.1
  • 8.x8.0.0 – 8.2.1Fixed in 8.2.2
  • 7.x and older5.5.0 – 7.7.0No fix, no longer updated

On 9.x, the newest line:

npm install find-my-way@9.0.1
Every release on a timeline
9.x

  1. Affected

    9.0.0

    1 release

  2. Fixed

    9.0.1 – 9.10.0

    11 releases, latest

8.x

  1. Affected

    8.0.0 – 8.2.1

    4 releases

  2. Fixed

    8.2.2

    1 release

7.x

  1. Affected

    7.0.0 – 7.7.0

    13 releases

6.x

  1. Affected

    6.0.0 – 6.4.0

    5 releases

5.x

  1. Not affected

    5.0.0 – 5.4.1

    7 releases

  2. Affected

    5.5.0 – 5.6.0

    3 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

What happens

Impact

A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-.

Patches

Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions.

Workarounds

No known workarounds.

References