What’s Vulnerable › Vulnerabilities

CVE-2024-45296: path-to-regexp outputs backtracking regular expressions

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-09 · updated 2026-06-17
• Weakness: CWE-1333

Description

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Affected products

• path-to-regexp: before 0.1.0; from 0.2.0 before 8.0.0 — fixed in 0.1.0, 8.0.0
• Npm Path-To-Regexp: from 0.2.0 before 1.9.0; before 0.1.10; from 7.0.0 before 8.0.0; from 2.0.0 before 3.3.0; from 4.0.0 before 6.3.0 — fixed in 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0

How to fix

Upgrade to a fixed version: path-to-regexp 0.1.0, 8.0.0; Npm Path-To-Regexp 1.9.0, 0.1.10, 8.0.0, 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://security.netapp.com/advisory/ntap-20250124-0001/

Get alerted when CVE-2024-45296 or the next vulnerability affects your stack