Upgrade to Prevent Poor Performance and DoS Attacks
CVE-2024-45296
7.5HIGH
What is CVE-2024-45296?
The path-to-regexp library, used to convert path strings into regular expressions, has a vulnerability that can lead to performance degradation. This occurs when a specific formatting of parameters is used, resulting in a complex regular expression that could monopolize the JavaScript main thread. As JavaScript operates in a single-threaded environment, this regex-induced slowdown can block the event loop, potentially leading to a denial of service condition. Users employing version 0.1 of the library should upgrade to 0.1.10, while all other versions should be updated to 8.0.0 to mitigate these performance risks.
Affected Version(s)
path-to-regexp < 0.1.10 < 0.1.10
path-to-regexp >= 0.2.0, < 8.0.0 < 0.2.0, 8.0.0