GHSA-27v5-c462-wpq7
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | path-to-regexp | >= 8.0.0, < 8.4.0 | 8.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
**Unsafe examples:**
```
/*foo-*bar-:baz
/*a-:b-*c-:d
/x/*a-:b/*c/y
```
**Safe examples:**
```
/*foo-:bar
/*foo-:bar-*baz
```
### Patches
Upgrade to version `8.4.0`.
### Workarounds
If developers are using multiple wildcard parameters, they can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
References
External links from the advisory. They lead to third-party sites.