GHSA-37ch-88jc-xwx2Published

path-to-regexp outputs backtracking regular expressions

Exploitation and risk

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2024-45296

Published

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Source published: 9 Sep 2024 19:07:40 UTC
Source modified: 24 Jan 2025 20:03:07 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

cve-program · CVE-2026-4867

Published

Impact: A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. Patches: Upgrade to [email protected] Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group. Workarounds: All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+). If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

Source published: 26 Mar 2026 16:16:25 UTC
Source modified: 26 Mar 2026 16:52:14 UTC
Saved here: 23 Oct 2026 15:48:27 UTC
Source terms: CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2024-2764

Published

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Sep 9, 2024, 7:07:40 PM

dateUpdated: Jan 24, 2025, 8:03:07 PM

45 related source bulletins · separate from aliases

RHSA-2024:7726: Red Hat Security Advisory: Red Hat OpenShift Service Mesh Containers for 2.6.2

CVE-2024-7264 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45806 · CVE-2024-45808 · CVE-2024-45810

RHSA-2024:10857: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes

CVE-2023-47108 · CVE-2024-45296 · CVE-2024-45813

openSUSE-SU-2024:14374-1: argocd-cli-2.12.4-1.1 on GA media

CVE-2024-45296

RHSA-2024:7599: Red Hat Security Advisory: OpenShift Container Platform 4.16.16 bug fix and security update

CVE-2023-3462 · CVE-2024-2961 · CVE-2024-6119 · CVE-2024-45296 · CVE-2024-45490 · CVE-2024-45491 · CVE-2024-45492

RHSA-2024:7922: Red Hat Security Advisory: OpenShift Container Platform 4.17.1 bug fix and security update

CVE-2023-3462 · CVE-2023-45290 · CVE-2024-3727 · CVE-2024-6345 · CVE-2024-6508 · CVE-2024-24786 · CVE-2024-24791 · CVE-2024-27289 · CVE-2024-45296

RHSA-2024:9885: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.0

CVE-2024-45296 · CVE-2024-45590

WID-SEC-W-2024-3733: Red Hat Advanced Cluster Management: Mehrere Schwachstellen

CVE-2024-45296 · CVE-2024-45813 · CVE-2024-45801

RHSA-2024:8581: Red Hat Security Advisory: Errata Advisory for Red Hat OpenShift GitOps v1.13.2 security update

CVE-2023-26115 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590

WID-SEC-W-2025-0580: IBM License Metric Tool: Mehrere Schwachstellen

CVE-2024-10917 · CVE-2024-12797 · CVE-2024-21208 · CVE-2024-21210 · CVE-2024-21217 · CVE-2024-21235 · CVE-2024-45296 · CVE-2024-52798 · CVE-2024-57965 · CVE-2025-27111 · CVE-2025-27152 · CVE-2025-25184

RHSA-2025:0875: Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update

CVE-2024-21538 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45590 · CVE-2024-48910 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326

RHSA-2024:7324: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.7

CVE-2024-6104 · CVE-2024-45296 · CVE-2024-45801

WID-SEC-W-2024-3542: Red Hat OpenShift: Mehrere Schwachstellen

CVE-2023-42282 · CVE-2024-29415 · CVE-2024-21534 · CVE-2024-34156 · CVE-2024-45296 · CVE-2024-45813 · CVE-2024-47875 · CVE-2024-48949

RHSA-2024:9884: Red Hat Security Advisory: Red Hat Trusted Profile Analyzer 1.2.0

CVE-2024-45296 · CVE-2024-45590

WID-SEC-W-2024-3344: HCL BigFix WebUI: Mehrere Open Source Schwachstellen

CVE-2023-26159 · CVE-2023-45857 · CVE-2024-21501 · CVE-2024-33883 · CVE-2024-35255 · CVE-2024-38996 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-8372 · CVE-2024-8373

WID-SEC-W-2025-0043: IBM QRadar SIEM (Log Source Management App): Mehrere Schwachstellen

CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-47068 · CVE-2024-47875 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-33883 · CVE-2024-37890 · CVE-2024-4067 · CVE-2024-4068 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-48948 · CVE-2024-48949 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-45801 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-47764

RHSA-2024:11293: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes

CVE-2023-47108 · CVE-2024-45296 · CVE-2024-45813

RHSA-2024:10962: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

CVE-2024-21536 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068

msrc_CVE-2024-45296: path-to-regexp outputs backtracking regular expressions

CVE-2024-45296

WID-SEC-W-2024-3534: Red Hat Trusted Profile Analyzer: Mehrere Schwachstellen ermöglichen Denial of Service

CVE-2024-45296 · CVE-2024-45590

RHSA-2024:10865: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.1 bug fixes and container updates

CVE-2024-45296 · CVE-2024-45813

RHSA-2025:3397: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791

RHBA-2024:11265: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.4.0 release.

CVE-2024-21536 · CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45815 · CVE-2024-45816 · CVE-2024-46976 · CVE-2024-47762

RHBA-2024:11558: Red Hat Bug Fix Advisory: Red Hat Quay v3.11.7 bug fix release

CVE-2024-39338 · CVE-2024-45296

WID-SEC-W-2024-3250: Red Hat OpenShift: Mehrere Schwachstellen

CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-39338 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45801

RHSA-2025:0082: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update

CVE-2023-26136 · CVE-2023-26364 · CVE-2024-21538 · CVE-2024-24791 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-48910 · CVE-2024-55565

RHSA-2024:10917: Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Jaeger) 3.4 release

CVE-2024-21536 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068

RHSA-2024:8014: Red Hat Security Advisory: Network Observability 1.7.0 for OpenShift

CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-39338 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-45801

WID-SEC-W-2026-0177: Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere Schwachstellen

CVE-2021-3807 · CVE-2022-25883 · CVE-2022-45693 · CVE-2024-21538 · CVE-2024-38286 · CVE-2024-45296 · CVE-2024-45801 · CVE-2025-12383 · CVE-2025-15284 · CVE-2025-27152 · CVE-2025-41249 · CVE-2025-48976 · CVE-2025-48989 · CVE-2025-49146 · CVE-2025-52434 · CVE-2025-52999 · CVE-2025-53689 · CVE-2025-54988 · CVE-2025-55163 · CVE-2025-55752 · CVE-2025-64775 · CVE-2025-66516 · CVE-2025-9287 · CVE-2025-9288 · CVE-2026-21569

RHSA-2024:10762: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update

CVE-2024-8775 · CVE-2024-9902 · CVE-2024-45296 · CVE-2024-45801

RHSA-2024:8676: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update

CVE-2023-26136 · CVE-2023-26364 · CVE-2024-24786 · CVE-2024-24789 · CVE-2024-28176 · CVE-2024-41818 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590

RHSA-2025:0323: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.13 Bug Fix Update

CVE-2023-26136 · CVE-2023-26364 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296

WID-SEC-W-2025-0001: IBM DB2: Mehrere Schwachstellen

CVE-2021-32740 · CVE-2021-41186 · CVE-2022-0759 · CVE-2022-24795 · CVE-2022-31163 · CVE-2023-39325 · CVE-2023-41993 · CVE-2023-45283 · CVE-2023-45288 · CVE-2023-6597 · CVE-2024-0406 · CVE-2024-20918 · CVE-2024-20952 · CVE-2024-2398 · CVE-2024-24786 · CVE-2024-27281 · CVE-2024-2961 · CVE-2024-29857 · CVE-2024-33599 · CVE-2024-33883 · CVE-2024-37370 · CVE-2024-37371 · CVE-2024-37890 · CVE-2024-39338 · CVE-2024-4068 · CVE-2024-41110 · CVE-2024-41123 · CVE-2024-41946 · CVE-2024-45296 · CVE-2024-45491 · CVE-2024-45590 · CVE-2024-47220 · CVE-2024-47554 · CVE-2024-6119 · CVE-2024-6345

RHSA-2024:11381: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes

CVE-2024-45296 · CVE-2024-45801 · CVE-2024-45813

RHSA-2025:1249: Red Hat Security Advisory: updated discovery container images

CVE-2020-11023 · CVE-2023-44270 · CVE-2024-6485 · CVE-2024-8775 · CVE-2024-21536 · CVE-2024-21538 · CVE-2024-31228 · CVE-2024-31449 · CVE-2024-39338 · CVE-2024-41989 · CVE-2024-41991 · CVE-2024-42005 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590 · CVE-2024-46981 · CVE-2024-52798 · CVE-2024-53907 · CVE-2024-55565 · CVE-2024-56201 · CVE-2024-56326 · CVE-2024-56374

RHSA-2024:10236: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.17.0 release

CVE-2023-42282 · CVE-2024-21534 · CVE-2024-29415 · CVE-2024-34155 · CVE-2024-34156 · CVE-2024-45296 · CVE-2024-45813 · CVE-2024-47875 · CVE-2024-48949

WID-SEC-W-2024-3211: IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service

CVE-2024-45296

NCSC-2026-0034: Kwetsbaarheden verholpen in Atlassian producten

RHSA-2024:10906: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update

CVE-2024-24790 · CVE-2024-24791 · CVE-2024-34155 · CVE-2024-34156 · CVE-2024-34158 · CVE-2024-43788 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296 · CVE-2024-45590

RHSA-2024:6122: Red Hat Security Advisory: OpenShift Container Platform 4.18.1 bug fix and security update

CVE-2023-44270 · CVE-2023-45288 · CVE-2024-3727 · CVE-2024-6104 · CVE-2024-6508 · CVE-2024-7387 · CVE-2024-9341 · CVE-2024-10963 · CVE-2024-12085 · CVE-2024-12698 · CVE-2024-21538 · CVE-2024-24786 · CVE-2024-39338 · CVE-2024-43803 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45496 · CVE-2024-47211 · CVE-2024-48910 · CVE-2024-50311 · CVE-2024-50312 · CVE-2024-52798 · CVE-2024-53104 · CVE-2025-21613 · CVE-2025-21614

RHSA-2025:0164: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.9 Bug Fix Update

CVE-2023-26136 · CVE-2023-26364 · CVE-2024-21538 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296

WID-SEC-W-2024-3674: Splunk Splunk Enterprise: Mehrere Schwachstellen

CVE-2021-44531 · CVE-2024-25710 · CVE-2024-26308 · CVE-2024-36114 · CVE-2024-36129 · CVE-2024-4067 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-45296 · CVE-2024-5535 · CVE-2024-6531 · CVE-2024-53243 · CVE-2024-53244 · CVE-2024-53245 · CVE-2024-53246 · CVE-2024-53247

RHSA-2025:0664: Red Hat Security Advisory: Release of OpenShift Serverless Logic 1.35.0 security update & enhancements

CVE-2024-24786 · CVE-2024-40094 · CVE-2024-45296

openSUSE-SU-2025:14663-1: velociraptor-0.7.0.4.git142.862ef23-1.1 on GA media

CVE-2023-1732 · CVE-2023-44270 · CVE-2023-45133 · CVE-2023-45683 · CVE-2023-46234 · CVE-2024-21538 · CVE-2024-23331 · CVE-2024-24786 · CVE-2024-28180 · CVE-2024-31207 · CVE-2024-37298 · CVE-2024-4067 · CVE-2024-4068 · CVE-2024-42459 · CVE-2024-42460 · CVE-2024-42461 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45811 · CVE-2024-45812 · CVE-2024-47068 · CVE-2024-47875 · CVE-2024-48948 · CVE-2024-48949 · CVE-2024-51744 · CVE-2024-55565 · CVE-2024-6104

RHSA-2024:11023: Red Hat Security Advisory: HawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.

CVE-2024-2700 · CVE-2024-4068 · CVE-2024-7885 · CVE-2024-8184 · CVE-2024-38816 · CVE-2024-43796 · CVE-2024-43799 · CVE-2024-43800 · CVE-2024-45296

RHSA-2025:3368: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

CVE-2024-21538 · CVE-2024-45296 · CVE-2024-45338 · CVE-2024-45339 · CVE-2024-52798 · CVE-2024-55565 · CVE-2024-56171 · CVE-2024-56201 · CVE-2025-22150 · CVE-2025-24928 · CVE-2025-26791

Source published: Sep 9, 2024, 7:07:40 PM (timezone not stated)
Source modified: Jan 24, 2025, 8:03:07 PM (timezone not stated)
Saved here: 15 Nov 2026 04:39:01 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-16273

Published

Additional publisher context

Original publisher date fields

datePublished: Mar 26, 2026, 4:16:25 PM

dateUpdated: Mar 26, 2026, 4:52:14 PM

1 related source bulletins · separate from aliases

RHSA-2026:34342: Red Hat Security Advisory: Cluster Observability Operator 1.5.0

CVE-2020-7753 · CVE-2021-33623 · CVE-2024-4068 · CVE-2024-45338 · CVE-2024-52011 · CVE-2025-22868 · CVE-2025-22870 · CVE-2025-22872 · CVE-2025-47911 · CVE-2025-58190 · CVE-2026-1526 · CVE-2026-1528 · CVE-2026-2229 · CVE-2026-4800 · CVE-2026-4867 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-6734 · CVE-2026-9277 · CVE-2026-9697 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-25680 · CVE-2026-25681 · CVE-2026-29063 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33814 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-33937 · CVE-2026-33938 · CVE-2026-33939 · CVE-2026-33940 · CVE-2026-33941 · CVE-2026-39821 · CVE-2026-42506 · CVE-2026-48779

Source published: Mar 26, 2026, 4:16:25 PM (timezone not stated)
Source modified: Mar 26, 2026, 4:52:14 PM (timezone not stated)
Saved here: 13 Nov 2026 13:59:23 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

EUVD CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2024-45296

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Deferred

Weakness classifications: CWE-1333

Original publisher date fields

published: 2024-09-09T19:15:13.330

lastModified: 2026-06-17T07:53:58.263

Source published: 9 Sep 2024 19:15:13 UTC
Source modified: 17 Jun 2026 07:53:58 UTC
Saved here: 25 Oct 2026 00:17:28 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-4867

Published

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-1333

Original publisher date fields

published: 2026-03-26T17:16:42.983

lastModified: 2026-06-17T10:57:21.827

1 source CPE criteria · context only

cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:node.js:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published: 26 Mar 2026 17:16:42 UTC
Source modified: 17 Jun 2026 10:57:21 UTC
Saved here: 25 Oct 2026 12:17:32 UTC
Source terms: NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-37ch-88jc-xwx2

Published

### Impact A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b-:c` or `/:a-:b-:c-:d`. The backtrack protection added in `[email protected]` only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking. ### Patches Upgrade to [[email protected]](https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13) Custom regex patterns in route definitions (e.g., `/:a-:b([^-/]+)-:c([^-/]+)`) are not affected because they override the default capture group. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b-:c` to `/:a-:b([^-/]+)-:c([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. ### References - [GHSA-9wv6-86v2-598j](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post: ReDoS the web](https://blakeembrey.com/posts/2024-09-web-redos/)

Source published: 27 Mar 2026 20:04:53 UTC
Source modified: 10 Sep 2026 03:50:36 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH

osv · GHSA-9wv6-86v2-598j

Published

### Impact A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`. ### Patches For users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`. These versions add backtrack protection when a custom regex pattern is not provided: - [0.1.10](https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10) - [1.9.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0) - [3.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0) - [6.3.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0) They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability. Version [7.1.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0) can enable `strict: true` and get an error when the regular expression might be bad. Version [8.0.0](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0) removes the features that can cause a ReDoS. ### Workarounds All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `/:a-:b` to `/:a-:b([^-/]+)`. If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster. ### Details Using `/:a-:b` will produce the regular expression `/^\/([^\/]+?)-([^\/]+?)\/?$/`. This can be exploited by a path such as `/a${'-a'.repeat(8_000)}/a`. [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) has a good example of why this occurs, but the TL;DR is the `/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms. ### References * [OWASP](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) * [Detailed blog post](https://blakeembrey.com/posts/2024-09-web-redos/)

Source published: 9 Sep 2024 20:19:15 UTC
Source modified: 10 Sep 2026 03:50:18 UTC
Saved here: 24 Oct 2026 13:17:17 UTC
Source terms: GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

Publisher rating · HIGH