path-to-regexp outputs backtracking regular expressions

🗓️ 09 Sep 2024 20:19:15Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 150 Views

path-to-regexp outputs unsafe backtracking regex causing potential Do

Reporter	Title	Published	Views	Family All 168
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Analyst Workflow for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	8 Jan 202518:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in path-to-regexp affects watsonx.data	30 Jan 202514:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Cloud Pak foundational services are addressed with IBM Cloud Pak for Business Automation 24.0.1-IF001	28 Feb 202509:11	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a denial of service due to pillarjs Path-to-RegExp (CVE-2024-45296).	28 Jan 202522:08	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service, DNS poisoning, and information disclosure might affect IBM Storage Defender – Resiliency Service	31 Oct 202416:25	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Product Hub is affected by several vulnerabilities	11 Dec 202422:59	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilities that can affect IBM Fusion HCI and IBM Fusion HCI for watsonx	31 May 202514:07	–	ibm
IBM Security Bulletins	Security Bulletin: A pillarjs path-to-regexp vulnerability affects IBM Safer Payments (CVE-2024-45296)	28 Jan 202522:08	–	ibm

Vulners

Node

pillarjs path-to-regexpRange4.0.0–6.3.0npm

pillarjs path-to-regexpRange7.0.0–8.0.0npm

pillarjs path-to-regexpRange2.0.0–3.3.0npm

pillarjs path-to-regexpRange0.2.0–1.9.0npm

pillarjs path-to-regexpRange<0.1.10npm

Source	Link
github	www.github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
github	www.github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
github	www.github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45296
github	www.github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
github	www.github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
github	www.github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
github	www.github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
security	www.security.netapp.com/advisory/ntap-20250124-0001
github	www.github.com/advisories/GHSA-9wv6-86v2-598j

24 Jan 2025 21:32Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00066

SSVC

CWE-1333