CVE-2024-52798

EUVD-2024-3506
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.7 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
pillarjspath-to-regexp
𝑥
< 0.1.12
ADP
Debian logo
Debian Releases
Debian Product
Codename
node-path-to-regexp
bookworm
6.2.1-1
fixed
bullseye
6.2.0-1
fixed
forky
8.3.0-1
fixed
sid
8.3.0-1
fixed
trixie
6.3.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
node-path-to-regexp
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
needs-triage
questing
needs-triage
xenial
needs-triage
node-express
bionic
not-affected
focal
not-affected
jammy
not-affected
noble
not-affected
oracular
not-affected
plucky
needs-triage
questing
needs-triage
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
https://security.netapp.com/advisory/ntap-20250124-0002/