path-to-regexp contains a ReDoS

Description

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296

Recommendation

Update the path-to-regexp package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.1.12
• Patched version(s): 0.1.12

References

• GHSA-rhx6-c78j-4q9w
• blakeembrey.com
• security.netapp.com
• CVE-2024-52798
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• path-to-regexp outputs backtracking regular expressions - CVE-2024-45296
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards - CVE-2026-4923
• path-to-regexp vulnerable to Denial of Service via sequential optional groups - CVE-2026-4926
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

path-to-regexp