p PatchFirst

CVE-2024-45296

CVE-2024-45296 · path-to-regexp outputs backtracking regular expressions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

CVSS 7.5 · High · EPSS 0.9% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • path-to-regexp

    Versions
    • < 0.1.10: Affected
    • >= 0.2.0, < 8.0.0: Affected

    No fix published

  • node-path-to-regexp Debian:12

    Versions
    • 6.2.1-1
    • 6.3.0-1
    • 8.3.0-1
    • 8.4.0-1
    • 8.4.1-1
    • 8.4.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-path-to-regexp Debian:13

    Affected ranges
    • ECOSYSTEM: < 6.3.0-1

    Update to 6.3.0-1

  • node-path-to-regexp Debian:14

    Affected ranges
    • ECOSYSTEM: < 6.3.0-1

    Update to 6.3.0-1

  • path-to-regexp npm

    Affected ranges
    • SEMVER: < 0.1.13

    Update to 0.1.13

  • path-to-regexp npm

    Affected ranges
    • SEMVER: ≥ 0.2.0, < 1.9.0

    Update to 1.9.0

  • path-to-regexp npm

    Affected ranges
    • SEMVER: < 0.1.10

    Update to 0.1.10

  • path-to-regexp npm

    Affected ranges
    • SEMVER: ≥ 7.0.0, < 8.0.0

    Update to 8.0.0

  • path-to-regexp npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 3.3.0

    Update to 3.3.0

  • path-to-regexp npm

    Affected ranges
    • SEMVER: ≥ 4.0.0, < 6.3.0

    Update to 6.3.0

  • node-path-to-regexp Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.1-1
    Affected ranges
    • ECOSYSTEM: < 1.0.1-1ubuntu0.16.04.1~esm1

    Update to 1.0.1-1ubuntu0.16.04.1~esm1

  • node-path-to-regexp Ubuntu:Pro:18.04:LTS

    Versions
    • 1.0.1-1
    Affected ranges
    • ECOSYSTEM: < 1.0.1-1ubuntu0.18.04.1~esm1

    Update to 1.0.1-1ubuntu0.18.04.1~esm1

  • node-path-to-regexp Ubuntu:Pro:20.04:LTS

    Versions
    • 3.0.0-2
    • 3.1.0-1
    • 6.1.0-2
    Affected ranges
    • ECOSYSTEM: < 6.1.0-2ubuntu0.1~esm1

    Update to 6.1.0-2ubuntu0.1~esm1

  • node-path-to-regexp Ubuntu:Pro:22.04:LTS

    Versions
    • 6.2.0-1
    • 6.2.0-2
    Affected ranges
    • ECOSYSTEM: < 6.2.0-2ubuntu0.1~esm1

    Update to 6.2.0-2ubuntu0.1~esm1

  • node-path-to-regexp Ubuntu:Pro:24.04:LTS

    Versions
    • 6.2.1-1
    Affected ranges
    • ECOSYSTEM: < 6.2.1-1ubuntu0.1~esm1

    Update to 6.2.1-1ubuntu0.1~esm1

  • node-express Ubuntu:25.10

    Versions
    • 4.21.0+~cs8.36.26-2
    • 4.21.2+~cs8.36.27-1
    • 4.21.2+~cs8.36.27-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-express Ubuntu:26.10

    Versions
    • 5.1.0+~cs12.3.3-1build1
    • 5.2.1+~cs12.3.9-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-express Ubuntu:26.04:LTS

    Versions
    • 4.21.2+~cs8.36.27-2
    • 4.21.2+~cs8.36.27-3
    • 5.1.0+~cs12.3.3-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →