Asymmetric denial of service - ReDoS In path-to-regexp
Description
path-to-regexp contains a ReDoS
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 0.1.12 | ||
 rpm rhel6 | - | - | |
rpm rhel7 | - | - | |
rpm rhel6 | - | - |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.