GHSA-j3q9-mxjg-w52f
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | path-to-regexp | >= 8.0.0, < 8.4.0 | 8.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service.
### Patches
Fixed in version 8.4.0.
### Workarounds
Limit the number of sequential optional groups in route patterns. Avoid passing user-controlled input as route patterns.
References
External links from the advisory. They lead to third-party sites.