CVE-2024-45296highCWE-1333

CVE-2024-45296: falha de alta gravidade em pillarjs path-to-regexp

path-to-regexp outputs backtracking regular expressions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar path-to-regexp+ Monitorar path-to-regexp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.9%
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
pillarjs · path-to-regexp
CVEs relacionadas — pillarjs path-to-regexp

No mesmo produto, das mais perigosas para as menos.

CVE-2024-52798HIGHpath-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xEPSS 0.8%