path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x
Priority MEDIUM 41CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 30 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00787 56th percentileScored 2026-11-07
Fix Partial path-to-regexp (pillarjs): 0.1.12path-to-regexp (npm): 0.1.12Red Hat: 13 advisoriesRed Hat: 11 fixed, 30 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| multiparty | path-to-regexp | before 0.1.12 | 0.1.12 | Patch available | CNA |
| — | path-to-regexp (npm) | before 0.1.12 | 0.1.12 | Patch available | GHSA-rhx6-c78j-4q9w |
- path-to-regexp Vendormultiparty Affected before 0.1.12 Fixed in 0.1.12 Patch available CNA
- path-to-regexp (npm) Vendor— Affected before 0.1.12 Fixed in 0.1.12 Patch available GHSA-rhx6-c78j-4q9w
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:* | — | — | multiparty |
- cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:* Versions — — ·multiparty
Remediation
- Fix · CNA path-to-regexp (pillarjs) Fixed in 0.1.12
- Fix · GHSA-rhx6-c78j-4q9w path-to-regexp (npm) Fixed in 0.1.12 Advisory →
Red Hat 13 advisories
- RHSA-2025:8761 Released 2025-06-10 · Red Hat rating ImportantHawtIO 4.2.0 for Red Hat build of Apache Camel 4 Release and security update.
- HawtIO HawtIO 4.2.0
- RHSA-2025:3397 Released 2025-03-31 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3374 Released 2025-03-27 · Red Hat rating ImportantRed Hat Developer Hub 1.5.1 release.
- Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Show 10 more Red Hat advisories
- RHSA-2025:3368 Released 2025-03-27 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2024:6122 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/azure-service-rhel9-operator +47
- RHSA-2024:6121 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
- RHSA-2025:1448 Released 2025-02-13 · Red Hat rating ImportantRHOAI 2.17.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.17 registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8 +5
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2025:0876 Released 2025-02-05 · Red Hat rating ModerateOpenShift Container Platform 4.17.15 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-docker-builder-rhel9, openshift4/ose-networking-console-plugin-rhel9
- RHSA-2025:0875 Released 2025-02-05 · Red Hat rating ImportantOpenShift Container Platform 4.17.15 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
- RHSA-2025:1051 Released 2025-02-05 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.5.8
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/kiali-ossmc-rhel8, openshift-service-mesh/kiali-rhel8, openshift-service-mesh/proxyv2-rhel8
- RHSA-2025:0783 Released 2025-01-28 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.6 Bug fix update
- RHODF 4.16 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-metrics-exporter-rhel9, odf4/ocs-rhel9-operator
- RHSA-2025:0775 Released 2025-01-28 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.3 Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-metrics-exporter-rhel9, odf4/ocs-rhel9-operator
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift GitOps | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Quay 3 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka | Affected | No fix planned: Out of support scope |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| HawtIO HawtIO 4.2.0 | Fixed | RHSA-2025:8761 |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0783 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2025:0775 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2025:1051 |
| Red Hat Developer Hub (RHDH) 1.4 | Fixed | — |
| Red Hat Developer Hub 1.5 | Fixed | RHSA-2025:3374 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:3368 |
| Red Hat OpenShift AI 2.17 | Fixed | RHSA-2025:1448 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:0875, RHSA-2025:0876 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6121, RHSA-2024:6122 |
Not affected: 22 products
- Multicluster Engine for Kubernetes
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- RHOSSM 2.5 for RHEL 8
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat Developer Hub (RHDH) 1.4
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.5
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.17
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Data Science (RHODS)
- Red Hat Trusted Artifact Signer
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52798
- 2026-10-03 Alias added: GHSA-rhx6-c78j-4q9w
- 2026-10-27 Affected versions changed · Red Hat
References
Other 5
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
- https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
- https://blakeembrey.com/posts/2024-09-web-redos
- https://github.com/pillarjs/path-to-regexp
- https://security.netapp.com/advisory/ntap-20250124-0002
More multiparty vulnerabilities
- TI-2024-30367 path-to-regexp outputs backtracking regular expressions CVSS 3.1HIGH 7.5
- TI-2026-04296 path-to-regexp vulnerable to Denial of Service via sequential optional groups CVSS 3.1HIGH 7.5
- TI-2026-59975 multiparty vulnerable to Denial of Service via unbounded part-header accumulation CVSS 3.1HIGH 7.5
- TI-2026-07187 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing CVSS 3.1HIGH 7.5
- TI-2026-07186 multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception CVSS 3.1HIGH 7.5
- TI-2026-07185 multiparty vulnerable to ReDoS via filename parsing CVSS 3.1HIGH 7.5
Sources
- CVE-2024-52798 · CVE Program
- CVE-2024-52798 · NVD
- FIRST EPSS
- GHSA-rhx6-c78j-4q9w · GitHub Advisory Database · CC BY 4.0
- CVE-2024-52798 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences