path-to-regexp outputs backtracking regular expressions
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.1.10, 8.0.0, 1.9.0, 3.3.0, 6.3.0, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- pillarjs path-to-regexp
fixed in 0.1.10; From 0.2.0 · fixed in 8.0.0
- path-to-regexpnpm
From 0.2.0 · fixed in 1.9.0
- path-to-regexpnpm
fixed in 0.1.10
- path-to-regexpnpm
From 7.0.0 · fixed in 8.0.0
- path-to-regexpnpm
From 2.0.0 · fixed in 3.3.0
- path-to-regexpnpm
From 4.0.0 · fixed in 6.3.0
- path-to-regexpnpm
fixed in 0.1.13