path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a…
Historical advisory recorded 25 Oct 2026 01:17:12 UTC. Read the latest advisory.
nvd · CVE-2024-52798
Publishedpath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
Read the publisher's advisoryAffected versions, risk and source history
nvd · CVE-2024-52798
PublishedNVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-1333
Original publisher date fields
published: 2024-12-05T23:15:06.310
lastModified: 2026-06-17T08:07:38.863
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON