Asymmetric denial of service - ReDoS In node-path-to-regexp
Description
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as {a}{b}{c}:z. The generated regex grows exponentially with the number of groups, causing denial of service.
Patches
Fixed in version 8.4.0.
Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | - | ||
debian 14 | 8.4.0-1 | ||
debian 11 | - | ||
debian 13 | - | ||
 npm | 8.4.0 | ||
 rpm rhel9 | - | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2.