CVE-2024-45296highCWE-1333

CVE-2024-45296: fallo de gravedad alta en pillarjs path-to-regexp

path-to-regexp outputs backtracking regular expressions

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear path-to-regexp+ Monitorear path-to-regexp

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.9%
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
pillarjs · path-to-regexp
CVEs relacionadas — pillarjs path-to-regexp

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-52798HIGHpath-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xEPSS 0.8%