Skip to content
OpenAdvisories
High · 7.7 CVE-2024-52798 EUVD-2024-3506GHSA-rhx6-c78j-4q9w

path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

Published Dec 5, 2024 · Updated Jan 24, 2025 · Assigned by GitHub_M

Vendor: pillarjs Product: path-to-regexp Package: argo-workflows Package: grafana-image-renderer Package: kubeflow-centraldashboard Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: nodejs-nodemon Package: path-to-regexp Package: reaper Package: sqlpad Package: sqlpad-compat Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Package: tileserver-gl Package: tileserver-gl-compat Ecosystem: Azure Linux Ecosystem: npm Ecosystem: Wolfi

Description

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.

Affected products

VendorProductAffectedFixed
pillarjs path-to-regexp < 0.1.12 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 nodejs-nodemon No fix yet —
Azure Linux 2 (CBL-Mariner) nodejs-nodemon No fix yet —
Azure Linux 2 (CBL-Mariner) reaper 3.1.1-16 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling argo-workflows 3.6.2-r1 —
Wolfi rolling grafana-image-renderer 3.11.6-r2 —
Wolfi rolling kubeflow-centraldashboard 1.9.2-r3 —
Wolfi rolling kubeflow-pipelines +11 2.3.0-r3 —
Wolfi rolling sqlpad +1 7.5.2-r0 —
Wolfi rolling thingsboard +4 3.8.1-r4 —
Wolfi rolling tileserver-gl +1 5.1.1-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm path-to-regexp < 0.1.12 0.1.12 GHSA-rhx6-c78j-4q9w

Advisories 4

References