CVE-2024-45296

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

• CWE-1333

• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://security.netapp.com/advisory/ntap-20250124-0001/

Published

Sep 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45290PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45291PHPSpreadsheet is a pure PHP library for reading and writing…8.8
• CVE-2024-45292PHPSpreadsheet is a pure PHP library for reading and writing…5.4
• CVE-2024-45293PHPSpreadsheet is a pure PHP library for reading and writing…7.5
• CVE-2024-45294The HL7 FHIR Core Artifacts repository provides the java cor…8.6
• CVE-2024-45295Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-45297Discourse is an open source platform for community discussio…4.3
• CVE-2024-45298Wiki.js is an open source wiki app built on Node.js. A disab…4.3
• CVE-2024-45299alf.io is an open source ticket reservation system for confe…6.5
• CVE-2024-4530The Business Card WordPress plugin through 1.0.0 does not ha…6.3
• CVE-2024-45300alf.io is an open source ticket reservation system for confe…5.9
• CVE-2024-45301Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In …5.3