CVE-2024-52798: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
- https://github.com/advisories/GHSA-9wv6-86v2-598j - https://blakeembrey.com/posts/2024-09-web-redos/
Other sources
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/path-to-regexpto a version that resolves this vulnerability.Fixed in 0.1.12 - Upgrade
Upgrade
path-to-regexpto a version that resolves this vulnerability.Fixed in 0.1.12 - Configuration
Adjust route parameter regexes so the regex used for both parameters does not overlap (to avoid ReDoS backtracking); additionally, avoid patterns like `/:a-:b` where two parameters appear within a single path segment when the separator is not `.`
path-to-regexp Route parameter regex configuration = Ensure the regex used for both parameters within the same path segment does not overlap to allow backtracking; avoid using two parameters in a single path segment when the separator is not `.`
Event History
Frequently Asked Questions
What is the severity of CVE-2024-52798?
CVE-2024-52798 has a moderate severity due to the potential for Denial of Service from backtracking in regular expressions.
How do I fix CVE-2024-52798?
To fix CVE-2024-52798, upgrade the 'path-to-regexp' package to version 0.1.12 or later.
What software is affected by CVE-2024-52798?
CVE-2024-52798 affects versions before 0.1.12 of the 'path-to-regexp' package.
What is the cause of CVE-2024-52798?
CVE-2024-52798 is caused by a vulnerable regular expression that allows for excessive backtracking.
Are there workarounds for CVE-2024-52798?
As a workaround for CVE-2024-52798, avoid using two parameters within a single path segment.