CVE-2024-45296highCWE-1333

CVE-2024-45296: high-severity vulnerability in pillarjs path-to-regexp

path-to-regexp outputs backtracking regular expressions

Published · Updated

Follow this CVE+ Monitor path-to-regexp+ Monitor path-to-regexp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.9%
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
pillarjs · path-to-regexp
Related CVEs — pillarjs path-to-regexp

In the same product, most dangerous first.

CVE-2024-52798HIGHpath-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xEPSS 0.8%