path-to-regexp outputs backtracking regular expressions
Priority MEDIUM 41CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 30 fixed, 24 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00932 60th percentileScored 2026-11-07
Fix Partial path-to-regexp (pillarjs): 0.1.10, 8.0.0path-to-regexp (npm): 1.9.0, 0.1.10, 8.0.0 +2Red Hat: 28 advisoriesRed Hat: 30 fixed, 24 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| multiparty | path-to-regexp | before 0.1.10; 0.2.0 to before 8.0.0 | 0.1.10, 8.0.0 | Patch available | CNA |
| — | path-to-regexp (npm) | 0.2.0 to before 1.9.0 | 1.9.0 | Patch available | GHSA-9wv6-86v2-598j |
| — | path-to-regexp (npm) | before 0.1.10 | 0.1.10 | Patch available | GHSA-9wv6-86v2-598j |
| — | path-to-regexp (npm) | 7.0.0 to before 8.0.0 | 8.0.0 | Patch available | GHSA-9wv6-86v2-598j |
| — | path-to-regexp (npm) | 2.0.0 to before 3.3.0 | 3.3.0 | Patch available | GHSA-9wv6-86v2-598j |
| — | path-to-regexp (npm) | 4.0.0 to before 6.3.0 | 6.3.0 | Patch available | GHSA-9wv6-86v2-598j |
- path-to-regexp Vendormultiparty Affected before 0.1.10; 0.2.0 to before 8.0.0 Fixed in 0.1.10, 8.0.0 Patch available CNA
- path-to-regexp (npm) Vendor— Affected 0.2.0 to before 1.9.0 Fixed in 1.9.0 Patch available GHSA-9wv6-86v2-598j
- path-to-regexp (npm) Vendor— Affected before 0.1.10 Fixed in 0.1.10 Patch available GHSA-9wv6-86v2-598j
- path-to-regexp (npm) Vendor— Affected 7.0.0 to before 8.0.0 Fixed in 8.0.0 Patch available GHSA-9wv6-86v2-598j
- path-to-regexp (npm) Vendor— Affected 2.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-9wv6-86v2-598j
- path-to-regexp (npm) Vendor— Affected 4.0.0 to before 6.3.0 Fixed in 6.3.0 Patch available GHSA-9wv6-86v2-598j
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:* | — | — | multiparty |
- cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:* Versions — — ·multiparty
Remediation
- Fix · CNA path-to-regexp (pillarjs) Fixed in 0.1.10, 8.0.0
- Fix · GHSA-9wv6-86v2-598j path-to-regexp (npm) Fixed in 1.9.0 Advisory →
- Fix · GHSA-9wv6-86v2-598j path-to-regexp (npm) Fixed in 0.1.10 Advisory →
- Fix · GHSA-9wv6-86v2-598j path-to-regexp (npm) Fixed in 8.0.0 Advisory →
- Fix · GHSA-9wv6-86v2-598j path-to-regexp (npm) Fixed in 3.3.0 Advisory →
- Fix · GHSA-9wv6-86v2-598j path-to-regexp (npm) Fixed in 6.3.0 Advisory →
Red Hat 28 advisories
- RHSA-2025:3397 Released 2025-03-31 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3368 Released 2025-03-27 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2024:6122 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
Show 25 more Red Hat advisories
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2025:0875 Released 2025-02-05 · Red Hat rating ImportantOpenShift Container Platform 4.17.15 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
- RHSA-2025:0664 Released 2025-01-23 · Red Hat rating ModerateRelease of OpenShift Serverless Logic 1.35.0 security update & enhancements
- 8Base-Openshift-Serverless-1.35 openshift-serverless-1/logic-data-index-ephemeral-rhel8, openshift-serverless-1/logic-data-index-postgresql-rhel8, openshift-serverless-1/logic-jobs-service-ephemeral-rhel8 +7
- RHSA-2025:0323 Released 2025-01-15 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.14.13 Bug Fix Update
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
- RHSA-2025:0164 Released 2025-01-09 · Red Hat rating ModerateRed Hat OpenShift Data Foundation 4.15.9 Bug Fix Update
- RHODF 4.15 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2024:11381 Released 2024-12-18 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40
- RHSA-2024:11293 Released 2024-12-17 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
- RHSA-2024:11023 Released 2024-12-12 · Red Hat rating ImportantHawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO 4.0.0 for Red Hat build of Apache Camel 4
- RHSA-2024:10962 Released 2024-12-11 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10917 Released 2024-12-10 · Red Hat rating ImportantRed Hat OpenShift distributed tracing platform (Jaeger) 3.4 release
- Red Hat OpenShift distributed tracing 3.4 registry.redhat.io/rhosdt/jaeger-query-rhel8
- RHSA-2024:10906 Released 2024-12-10 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.8.5 security and bug fix update
- 8Base-RHMTC-1.8 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-ui-rhel8 +1
- RHSA-2024:10865 Released 2024-12-05 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.12.1 bug fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
- RHSA-2024:10857 Released 2024-12-05 · Red Hat rating ModerateMulticluster Engine for Kubernetes 2.7.2 security updates and bug fixes
- multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
- multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
- RHSA-2024:10762 Released 2024-12-03 · Red Hat rating ModerateRed Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.4 for RHEL 8 ansible-core-1:2.15.13-1.el8ap, automation-controller-venv-tower-4.5.13-1.el8ap
- Red Hat Ansible Automation Platform 2.4 for RHEL 9 ansible-core-1:2.15.13-1.el9ap, automation-controller-venv-tower-4.5.13-1.el9ap
- RHSA-2024:10236 Released 2024-11-25 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.17.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel8, devspaces/dashboard-rhel8, devspaces/udi-rhel8
- RHSA-2024:9885 Released 2024-11-18 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.0
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-guac-rhel9
- RHSA-2024:9884 Released 2024-11-18 · Red Hat rating ImportantRed Hat Trusted Profile Analyzer 1.2.0
- Red Hat Trusted Profile Analyzer 1.2 registry.redhat.io/rhtpa/rhtpa-trustification-service-rhel9
- RHSA-2024:8676 Released 2024-10-30 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
- RHSA-2024:8581 Released 2024-10-29 · Red Hat rating ImportantErrata Advisory for Red Hat OpenShift GitOps v1.13.2 security update
- Red Hat OpenShift GitOps 1.13 openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 +7
- RHSA-2024:8014 Released 2024-10-22 · Red Hat rating ImportantNetwork Observability 1.7.0 for OpenShift
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
- RHSA-2024:7922 Released 2024-10-16 · Red Hat rating ImportantOpenShift Container Platform 4.17.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:7599 Released 2024-10-09 · Red Hat rating ImportantOpenShift Container Platform 4.16.16 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/ose-installer-rhel9, openshift4/ose-monitoring-plugin-rhel9, rhcos
- RHSA-2024:7726 Released 2024-10-07 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.6.2
- RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
- RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9
- RHSA-2024:7324 Released 2024-10-02 · Red Hat rating ModerateLogging for Red Hat OpenShift - 5.9.7
- RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Developer Hub 1 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift distributed tracing 3 | Affected | No fix yet |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Virtualization 4 | Affected | No fix planned: Out of support scope |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet |
| 8Base-Openshift-Serverless-1.35 | Fixed | RHSA-2025:0664 |
| 8Base-RHMTC-1.8 | Fixed | RHSA-2024:10906 |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| HawtIO 4.0.0 for Red Hat build of Apache Camel 4 | Fixed | RHSA-2024:11023 |
| NETOBSERV 1.7 for RHEL 9 | Fixed | RHSA-2024:8014 |
| Quay v3 | Fixed | — |
| RHODF 4.14 for RHEL 9 | Fixed | RHSA-2025:0323 |
| RHODF 4.15 for RHEL 9 | Fixed | RHSA-2025:0164 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0082 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2024:8676 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:7324 |
| RHOSSM 2.6 for RHEL 8 | Fixed | RHSA-2024:7726 |
| RHOSSM 2.6 for RHEL 9 | Fixed | RHSA-2024:7726 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | Fixed | RHSA-2024:11381 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | Fixed | RHSA-2024:10865 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Fixed | RHSA-2024:10762 |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Fixed | RHSA-2024:10762 |
| Red Hat Developer Hub (RHDH) 1.4 | Fixed | — |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:3368 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:7599 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:7922, RHSA-2025:0875 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6122 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2024:10236 |
| Red Hat OpenShift GitOps 1.13 | Fixed | RHSA-2024:8581 |
| Red Hat OpenShift distributed tracing 3.4 | Fixed | RHSA-2024:10917, RHSA-2024:10962 |
| Red Hat Trusted Profile Analyzer 1.2 | Fixed | RHSA-2024:9884, RHSA-2024:9885 |
| multicluster engine for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2024:11293 |
| multicluster engine for Kubernetes 2.6 for RHEL 9 | Fixed | RHSA-2024:11293 |
| multicluster engine for Kubernetes 2.7 for RHEL 8 | Fixed | RHSA-2024:10857 |
| multicluster engine for Kubernetes 2.7 for RHEL 9 | Fixed | RHSA-2024:10857 |
Not affected: 24 products
- 8Base-RHMTC-1.8
- Migration Toolkit for Virtualization
- RHODF 4.14 for RHEL 9
- RHODF 4.15 for RHEL 9
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform 2.4 for RHEL 8
- Red Hat Ansible Automation Platform 2.4 for RHEL 9
- Red Hat Developer Hub (RHDH) 1.4
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Dev Spaces 3
- Red Hat OpenShift distributed tracing 3
- Red Hat OpenShift distributed tracing 3.4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-45296
- 2026-10-03 Alias added: GHSA-9wv6-86v2-598j
- 2026-10-27 Affected versions changed · Red Hat
- 2026-11-05 Affected versions changed · Red Hat
References
Other 9
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
- https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
- https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
- https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
- https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
- https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
- https://github.com/pillarjs/path-to-regexp
- https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
- https://security.netapp.com/advisory/ntap-20250124-0001
More multiparty vulnerabilities
- TI-2024-35311 path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x CVSS 4.0HIGH 7.7
- TI-2026-04296 path-to-regexp vulnerable to Denial of Service via sequential optional groups CVSS 3.1HIGH 7.5
- TI-2026-59975 multiparty vulnerable to Denial of Service via unbounded part-header accumulation CVSS 3.1HIGH 7.5
- TI-2026-07187 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing CVSS 3.1HIGH 7.5
- TI-2026-07186 multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception CVSS 3.1HIGH 7.5
- TI-2026-07185 multiparty vulnerable to ReDoS via filename parsing CVSS 3.1HIGH 7.5
Sources
- CVE-2024-45296 · CVE Program
- CVE-2024-45296 · NVD
- FIRST EPSS
- GHSA-9wv6-86v2-598j · GitHub Advisory Database · CC BY 4.0
- CVE-2024-45296 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences