Loading vulnerability…
Regular Expression Denial of Service in path-to-regexp
CVE-2024-45296 is a regular expression denial-of-service vulnerability in path-to-regexp, a JavaScript library that converts route patterns into regular expressions. Patterns containing two parameters within a single path segment, separated by something other than a period, can generate expressions susceptible to excessive backtracking. Crafted paths evaluated against these expressions can severely degrade performance and block the JavaScript event loop, causing denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Excessive regular-expression backtracking consumes processing time on the JavaScript main thread, blocking the event loop. Applications using affected route patterns can experience increased latency, severe performance degradation, and denial of service.
If you can’t patch tonight, do this now.
Rewrite vulnerable route patterns or supply custom regular expressions for parameters after the first in a segment, ensuring later parameters cannot match preceding text. Version 7.1.0 can use strict: true to reject potentially unsafe regular-expression generation. If rewriting routes and upgrading are not possible, limit URL length to reduce exploitability.
Patch, then assume compromise.
Upgrade path-to-regexp to a fixed release for the applicable branch: 0.1.10, 1.9.0, 3.3.0, or 6.3.0, or preferably migrate to 8.0.0, which removes the vulnerable feature set. The initial 0.1.x fix was subsequently identified as incomplete under CVE-2024-52798; deployments remaining on that branch should upgrade to at least 0.1.12 to address that follow-on vulnerability. For bundled dependencies, install the applicable vendor security updates and updated container images.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.