CVE-2024-52798
path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
CVE-2024-52798- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2024-3506
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
EUVD-2024-3506- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhx6-c78j-4q9w
path-to-regexp contains a ReDoS
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
- Record
GHSA-rhx6-c78j-4q9w- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
CVE-2024-52798- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSV
path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
CVE-2024-52798- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-rhx6-c78j-4q9w
path-to-regexp contains a ReDoS
Impact
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Patches
Upgrade to 0.1.12.
Workarounds
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
References
- Record
GHSA-rhx6-c78j-4q9w- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2024-52798
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
UBUNTU-CVE-2024-52798- CVSS 4.0
- 7.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
OSVAZL-54017 No score
CVE-2024-52798 affecting package nodejs-nodemon 2.0.3-4
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
AZL-54017- Updated
- 2026-11-02
OSVAZL-54020 No score
CVE-2024-52798 affecting package reaper for versions less than 3.1.1-16
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
AZL-54020- Updated
- 2026-11-02
OSVAZL-54036 No score
CVE-2024-52798 affecting package nodejs-nodemon 2.0.3-5
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
- Record
AZL-54036- Updated
- 2026-11-05
OSVCLSA-2026-1773360981 No score
TuxCare security update for path-to-regexp (2 CVEs)
TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.3-tuxcare.1.
- Record
CLSA-2026-1773360981- Updated
- 2026-11-02
OSVCLSA-2026-1790520007 No score
TuxCare security update for path-to-regexp (1 CVE)
TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.10-tuxcare.1.
- Record
CLSA-2026-1790520007- Updated
- 2026-11-02
OSVCLSA-2026-1791843328 No score
TuxCare security update for path-to-regexp (2 CVEs)
TuxCare rebuilt path-to-regexp to address 2 CVEs. Fixed in 0.1.7-tuxcare.1.
- Record
CLSA-2026-1791843328- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-52798 No score
CVE-2024-52798 in @rootio/path-to-regexp - Patched by Root
Root has patched CVE-2024-52798 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-52798- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
path-to-regexpnpm |
before 0.1.12 | 0.1.12 |
nodejs-nodemonAzure Linux:2 |
through 2.0.3-4 | None known |
reaperAzure Linux:2 |
before 3.1.1-16 | 3.1.1-16 |
nodejs-nodemonAzure Linux:3 |
through 2.0.3-5 | None known |
path-to-regexpTuxCare:npm From an advisory covering 2 CVEs |
0.1.3-tuxcare.0 up to 0.1.3-tuxcare.1, plus listed versions 0.1.3 |
0.1.3-tuxcare.1 |
path-to-regexpTuxCare:npm |
0.1.10-tuxcare.0 up to 0.1.10-tuxcare.1, plus listed versions 0.1.10 |
0.1.10-tuxcare.1 |
path-to-regexpTuxCare:npm From an advisory covering 2 CVEs |
0.1.7-tuxcare.0 up to 0.1.7-tuxcare.1, plus listed versions 0.1.7 |
0.1.7-tuxcare.1 |
@rootio/path-to-regexpRoot:npm |
before 0.1.7-root.io.2 | 0.1.7-root.io.20.1.7-root.io.30.1.10-root.io.20.1.10-root.io.30.1.12-root.io.10.1.12-root.io.2 |
path-to-regexpRoot:npm |
before 0.1.7-aikido.3 | 0.1.7-aikido.30.1.10-aikido.20.1.10-aikido.30.1.12-aikido.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52798 is a high vulnerability (CVSS 7.7) in Path-to-regexp, published December 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in path-to-regexp 0.1.12.
References
github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
security.netapp.com/advisory/ntap-20250124-0002
blakeembrey.com/posts/2024-09-web-redos
nvd.nist.gov/vuln/detail/CVE-2024-52798