path-to-regexp outputs backtracking regular expressions

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2024-45296 · CVE overview and exploitation status

CVE-2026-4867 · CVE overview and exploitation status

EUVD-2024-2764

GHSA-9wv6-86v2-598j

EUVD-2026-16273

GHSA-37ch-88jc-xwx2

cve-program · CVE-2024-45296

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6

cve-program · CVE-2026-4867

• https://github.com/advisories/GHSA-9wv6-86v2-598j
• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2024-2764

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6

euvd · EUVD-2026-16273

• https://github.com/advisories/GHSA-9wv6-86v2-598j
• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2024-45296

• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://security.netapp.com/advisory/ntap-20250124-0001/

nvd · CVE-2026-4867

• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-9wv6-86v2-598j

osv · GHSA-37ch-88jc-xwx2

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
• https://nvd.nist.gov/vuln/detail/CVE-2026-4867
• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp
• https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13

osv · GHSA-9wv6-86v2-598j

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://nvd.nist.gov/vuln/detail/CVE-2024-45296
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
• https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
• https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
• https://github.com/pillarjs/path-to-regexp
• https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
• https://security.netapp.com/advisory/ntap-20250124-0001

No related changes are available here.