Path-to-regexp Vulnerability Caused by incomplete fix for CVE-2024-45296
CVE-2024-52798

7.7HIGH

Key Information:

Vendor

Pillarjs

Status
Path-to-regexp
Vendor
CVE Published:
5 December 2024

What is CVE-2024-52798?

The path-to-regexp library from PillarJS contains a vulnerability that can lead to performance degradation due to the generation of inefficient regular expressions. Specifically, in versions 0.1.x, a backtracking issue can arise that severely impacts application performance when handling specific path strings. This vulnerability is a result of an incomplete fix related to a previous vulnerability. Users are advised to upgrade to version 0.1.12 or later to mitigate these performance-related risks.

Affected Version(s)

path-to-regexp < 0.1.12

References

https://github.com/pillarjs/path-to-regexp/security/advis...
x_refsource_CONFIRM
https://github.com/pillarjs/path-to-regexp/commit/f01c26a...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.