External/card-drop

Fork 0

[19] [HIGH] path-to-regexp contains a ReDoS #459

New issue

Open

opened 2025-06-04 18:36:23 +01:00 by Vylpes · 1 comment

Vylpes commented

2025-06-04 18:36:23 +01:00

Owner

Package: path-to-regexp
Affected versions: < 0.1.12
Patched version: 0.1.12

Impact

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

Package: `path-to-regexp` Affected versions: `< 0.1.12` Patched version: `0.1.12` --- ## Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296 ## Patches Upgrade to 0.1.12. ## Workarounds Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

Vylpes added this to the 0.10.0 milestone 2025-06-04 18:36:23 +01:00

Vylpes added the

type

alert

label 2025-06-04 18:36:23 +01:00

Vylpes commented

2025-06-04 18:36:26 +01:00

Author

Owner

Upgrade path-to-regexp to version 0.1.12 or later. For example:

path-to-regexp@^0.1.12:
  version "0.1.12"

Upgrade path-to-regexp to version 0.1.12 or later. For example: ``` path-to-regexp@^0.1.12: version "0.1.12" ```

No labels

requires documentation

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: External/card-drop#459

No description provided.

Rows
Columns