---
title: "GHSA-rrr8-f88r-h8q6: find-my-way has a ReDoS vulnerability in multiparametric routes"
description: "High severity. find-my-way has a ReDoS vulnerability in multiparametric routes. Affects find-my-way; fixed in 9.0.1."
url: https://inlinr.com/advisories/GHSA-rrr8-f88r-h8q6
lang: en
---

[Packages](https://inlinr.com/packages) / [find-my-way](https://inlinr.com/packages/find-my-way) / [Security](https://inlinr.com/packages/find-my-way/security)

High Vulnerability GHSA-rrr8-f88r-h8q6 CVE-2024-45813 Published 18 Sep 2024

# find-my-way has a ReDoS vulnerability in multiparametric routes

Your version 

Affected releases · [find-my-way](https://inlinr.com/packages/find-my-way)

- 9.x 9.0.0 Fixed in 9.0.1
- 8.x 8.0.0 – 8.2.1 Fixed in 8.2.2
- 7.x and older 5.5.0 – 7.7.0 No fix, no longer updated

On 9.x, the newest line:

```
npm install find-my-way@9.0.1
```

Every release on a timeline

9.x 

1. Affected

9.0.0  
1 release
2. Fixed

9.0.1 – 9.10.0  
11 releases, latest

8.x 

1. Affected

8.0.0 – 8.2.1  
4 releases
2. Fixed

8.2.2  
1 release

7.x 

1. Affected

7.0.0 – 7.7.0  
13 releases

6.x 

1. Affected

6.0.0 – 6.4.0  
5 releases

5.x 

1. Not affected

5.0.0 – 5.4.1  
7 releases
2. Affected

5.5.0 – 5.6.0  
3 releases

121 stable releases of find-my-way, oldest to newest, one row per major.

## What happens

Impact

A bad regular expression is generated any time you have two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`.

Patches

Update to find-my-way v8.2.2 or v9.0.1\. or subsequent versions.

Workarounds

No known workarounds.

References

- [CVE-2024-45296](https://github.com/advisories/GHSA-9wv6-86v2-598j "https://github.com/advisories/GHSA-9wv6-86v2-598j")
- [Detailed blog post about path-to-regexp vulnerability](https://blakeembrey.com/posts/2024-09-web-redos/ "https://blakeembrey.com/posts/2024-09-web-redos/")

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6 "https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6")  
github.com/delvedor/find-my-way/security/adviso…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-45813 "https://nvd.nist.gov/vuln/detail/CVE-2024-45813")  
nvd.nist.gov/vuln/detail/CVE-2024-45813
- [Fix commit](https://github.com/delvedor/find-my-way/commit/17fae694dcefc056045da201681c1530f0f80518 "https://github.com/delvedor/find-my-way/commit/17fae694dcefc056045da201681c1530f0f80518")  
17fae69
- [Fix commit](https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440 "https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440")  
5e9e0eb
- [Fix commit](https://github.com/delvedor/find-my-way/commit/66fa03923355b8da1db4ba572d66a4fee4a57cf5 "https://github.com/delvedor/find-my-way/commit/66fa03923355b8da1db4ba572d66a4fee4a57cf5")  
66fa039
- [Reference](https://blakeembrey.com/posts/2024-09-web-redos "https://blakeembrey.com/posts/2024-09-web-redos")  
blakeembrey.com/posts/2024-09-web-redos
- [Related advisory](https://github.com/advisories/GHSA-9wv6-86v2-598j "https://github.com/advisories/GHSA-9wv6-86v2-598j")  
github.com/advisories/GHSA-9wv6-86v2-598j
- [Package](https://github.com/delvedor/find-my-way "https://github.com/delvedor/find-my-way")  
github.com/delvedor/find-my-way