path-to-regexp contains a ReDoS

🗓️ 05 Dec 2024 22:40:47Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 47 Views

Unpatched path-to-regexp ReDoS issue in version 0.1.x, upgrade to 0.1.12 for patching.

Reporter	Title	Published	Views	Family All 87
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite Ai-Broker Component uses CVE-2024-52798 path-to-regexp-0.1.10.tgz (Publicly disclosed vulnerability found by Mend) CVE-2024-52798	20 Feb 202506:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in MongoDB, Python, Node.js, Golang Go, Linux kernel affect IBM Spectrum Protect Plus	10 Mar 202620:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	6 May 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Decision Optimization for Cloud Pak for Data is vulnerable to backtracking (CVE-2024-52798)	5 Mar 202516:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	12 Mar 202511:26	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Data Virtualization on Cloud Pak for Data (February 2025)	15 Apr 202503:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is vulnerable to multiple vulnerabilities found in Java and Node.js	27 Jan 202514:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Controller	4 Dec 202514:46	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager.	15 Apr 202503:26	–	ibm

Vulners

Node

pillarjs path-to-regexpRange<0.1.12npm

Source	Link
github	www.github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
blakeembrey	www.blakeembrey.com/posts/2024-09-web-redos
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-52798
github	www.github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
security	www.security.netapp.com/advisory/ntap-20250124-0002
github	www.github.com/advisories/GHSA-rhx6-c78j-4q9w

03 Jun 2025 14:30Current

6.5Medium risk

Vulners AI Score6.5

CVSS 48.7

EPSS0.00293

SSVC

path-to-regexp vulnerability redos impact version 0.1.x upgrade to 0.1.12 workaround for backtracking