path-to-regexp contains a ReDoS
Published 5 Dec 2024 · Updated 10 Sept 2026
Affected package
- Affected
- <0.1.12
- Fixed in
- 0.1.12
npm install path-to-regexp@0.1.12Details
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
- https://github.com/advisories/GHSA-9wv6-86v2-598j
- https://blakeembrey.com/posts/2024-09-web-redos/
Is GHSA-rhx6-c78j-4q9w in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected path-to-regexp, and gives you the command that fixes it.
References
- Linkgithub.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
- Advisorynvd.nist.gov/vuln/detail/CVE-2024-52798
- Linkgithub.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
- Linkblakeembrey.com/posts/2024-09-web-redos
- Packagegithub.com/pillarjs/path-to-regexp
- Linksecurity.netapp.com/advisory/ntap-20250124-0002
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.