| Package | Affected versions | Patched versions |
|---|---|---|
| path-to-regexp | < 0.1.12 | 0.1.12 |
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296
Upgrade to 0.1.12.
Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free