AIKIDO-2024-10181
path-to-regexp is vulnerable to Regular Expression Denial of Service (ReDoS)
77
High Risk
This Affects:
path-to-regexpTL;DR
The patched version adds a strict option to detect potential ReDoS issues. A bad regular expression is generated whenever two parameters within a single segment are separated by something other than a period (.). For example, /:a-:b.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
path-to-regexp is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 0.1 - 0.1.11, 0.2.0 - 1.8.0, 2.0.0 - 3.2.0, 4.0.0 - 6.2.2 and 7.0.0 - 7.0.0.
How to fix this
Upgrade the path-to-regexp library to the patched version. For patch version 7.1.0, use the 'strict: true' option. Older patch versions add backtrack protection but do not protect against vulnerable user-supplied capture groups. It is advised to upgrade to version 8.0.0, which removes the vulnerable feature entirely.
Links
CVE Details
Fix Commits
github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476fgithub.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant