CVE Tools
Sign in

CVE-2024-45296

path-to-regexp outputs backtracking regular expressions

Published: Sep 9, 2024Updated: Jan 24, 2025 Sources: CVE List NVD GHSACWE-1333
7.5HIGH
NVD MITRE
EPSS Score
0.9%
Top 42.6%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
OpenVAS

Description

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:NI:NA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:NConfidentiality
None
I:NIntegrity
None
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-1333

Affected Products

pillarjs
oss-project
path-to-regexpLibrary
OSS Libraries / web-framework
npm
package-ecosystem
path-to-regexp
OSS Libraries

Exploitability

Official Patch Available
Is your org exposed to CVE-2024-45296?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique
Impact
View detailed technique mapping

References

https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
github.com
https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
github.com
https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
github.com
and 8 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2024-45296 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows