| Package | Affected versions | Patched versions |
|---|---|---|
| path-to-regexp | ≥ 0.2.0, < 1.9.0≥ 2.0.0, < 3.3.0≥ 4.0.0, < 6.3.0≥ 7.0.0, < 8.0.0< 0.1.10< 0.1.13 | 1.9.03.3.06.3.08.0.00.1.100.1.13 |
A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in [email protected] only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.
Upgrade to [email protected]
Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.
All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).
If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free