CVE-2024-52798

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgra...

@_unit/unit (>=1.0.44 <=1.0.58), @abtnode/blocklet-services (>=1.16.33 <=1.17.12-beta-20260420-061403-d7b5c4e6) +651 more potentially affected by CVE-2024-52798 via path-to-regexp (>=0.0.2 <=0.1.11)

path-to-regexp NPM version =0.0.2, =1.0.44, =1.16.33, =1.16.33, =16.7.2, =1.0.1, =1.11.282, =1.1.55, =0.1.5-alpha.0, =1.13.0, =1.13.0, =0.25.10, =1.0.31, =1.0.32 and more Source cves: CVE-2024-52798 Source advisory: OSV:GHSA-RHX6-C78J-4Q9W...

path-to-regexp contains a ReDoS

Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296 Patches Upgrade to 0.1.12. Workarounds Avoid using two parameters within a single path segment, when the separator is not . e.g. no...

GHSA-RHX6-C78J-4Q9W path-to-regexp contains a ReDoS

Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296 Patches Upgrade to 0.1.12. Workarounds Avoid using two parameters within a single path segment, when the separator is not . e.g. no...

PT-2024-35449

Name of the Vulnerable Software and Affected Versions path-to-regexp versions 0.1.x through 0.1.11 Description The issue concerns a performance vulnerability in path-to-regexp, where certain inputs can generate regular expressions vulnerable to backtracking, leading to poor performance. This...

path-to-regexp 安全漏洞

Path-to-RegExp is an open source tool from pillarjs. It is used to convert path strings to regular expressions. A security vulnerability exists in versions prior to path-to-regexp 0.1.12. An attacker exploiting this vulnerability can cause poor performance...

path-to-regexp: Backtracking regular expressions cause ReDoS

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in path-to-regexp-0.1.7.tgz

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of path-to-regexp-0.1.7.tgz Vulnerability Details CVEID:CVE-2024-45296 DESCRIPTION: pillarjs Path-to-RegExp is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw. By...

Security Bulletin: Denial of service, DNS poisoning, and information disclosure might affect IBM Storage Defender – Resiliency Service

Summary IBM Storage Defender – Resiliency Service is vulnerable and can result in denial of service, DNS poisoning, and information disclosure. The vulnerabilities have been addressed. CVE-2024-34447, CVE-2024-30172, CVE-2024-30171, CVE-2024-29857, CVE-2024-45296, CVE-2023-44487, CVE-2024-29857...

path-to-regexp outputs backtracking regular expressions

...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.16 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.16 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

SUSE CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event...

find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

GHSA-RRR8-F88R-H8Q6 find-my-way has a ReDoS vulnerability in multiparametric routes

Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a - at the end, like /:a-:b-. Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. Workarounds No known workarounds. References - CVE-2024-45296 - Detailed blog po...

Denial Of Service (DoS)

path-to-regexp is vulnerable to Denial Of Service DoS. The vulnerability is due to the generation of inefficient regular expressions when path strings contain two parameters within a single segment separated by a non-period character, allowing an attacker to cause high CPU usage and potentially...

CVE-2024-45296

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

@betit/orion (>=0.1.3 <=0.1.17), @nichoth/router (>=0.0.0 <=0.0.2) +124 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.0.2 <=0.1.0)

path-to-regexp NPM version =0.0.2, =0.1.3, =0.0.0, =0.0.0, =0.0.1, =0.0.9-beta.1, =0.0.2, =2.0.0, =0.2.0, =0.0.1, =0.0.1, =1.0.6, =0.1.1, =0.1.2 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

06-react-router-myself (>=0.0.1 <=0.0.2), 07-building-a-router (>=0.0.1 <=0.0.2) +194 more potentially affected by CVE-2024-45296 via path-to-regexp (>=7.0.0 <=7.2.0)

path-to-regexp NPM version =7.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =5.0.0, =2.13.21, =8.0.0, =4.0.34, =15.0.10, =4.0.0, =10.5.0, =0.0.9, =9.0.0, =9.5.0, =9.5.36 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

07-cesar-router (=0.0.2), 07-custom-router (>=0.0.1 <=0.0.4) +1386 more potentially affected by CVE-2024-45296 via path-to-regexp (>=4.0.3 <=6.2.2)

path-to-regexp NPM version =4.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1, =0.0.0, =0.0.1, =0.0.5, =0.0.1, =0.0.0-canary.0, =0.0.0-canary.6 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...

10chars-test (>=1.0.0 <=1.0.34), 128981semzub (=1.0.1) +1463 more potentially affected by CVE-2024-45296 via path-to-regexp (>=0.2.5 <=1.8.0)

path-to-regexp NPM version =0.2.5, =1.0.0, =4.0.61, =4.0.61, =4.0.61, =0.0.3, =0.0.1, =1.1.11, =2.0.0, =0.0.1, =1.0.0, =3.3.9-patch.1, =3.0.0, =3.0.3 and more Source cves: CVE-2024-45296 Source advisory: OSV:GHSA-9WV6-86V2-598J...