path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Impact
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.
Patches
Upgrade to path-to-regexp@0.1.13
Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.
Workarounds
All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).
If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
References
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | path-to-regexp | < 0.1.13 | 0.1.13 |
Referencias
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
- https://nvd.nist.gov/vuln/detail/CVE-2024-45296
- https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
- https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
- https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
- https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
- https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
- https://github.com/pillarjs/path-to-regexp
- https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
- https://security.netapp.com/advisory/ntap-20250124-0001
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
- https://nvd.nist.gov/vuln/detail/CVE-2026-4867
- https://blakeembrey.com/posts/2024-09-web-redos
- https://cna.openjsf.org/security-advisories.html
- https://github.com/advisories/GHSA-9wv6-86v2-598j
- https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Debilidad (CWE)
CWE-1333- Plataforma
- npm
- Paquete
path-to-regexp- Publicada
- 09.09.2024
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-37ch-88jc-xwx2 - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-9wv6-86v2-598j - CC BY 4.0
Historial de vulnerabilidades: path-to-regexp
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 4
- Primera → última
- 09.2024 03.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 3
- Media 1
Divulgaciones por año
- 2024: 2
- 2025: 0
- 2026: 2
-
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.