GHSA-rhx6-c78j-4q9w high
path-to-regexp contains a ReDoS
Affected range
SEMVER: introduced 0; fixed 0.1.12Fixed versions: 0.1.12
path-to-regexp
Express style path to RegExp utility
npm latest 8.4.2 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
8.4.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
4 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-j3q9-mxjg-w52f high
path-to-regexp vulnerable to Denial of Service via sequential optional groups
Affected range
SEMVER: introduced 8.0.0; fixed 8.4.0Fixed versions: 8.4.0
GHSA-37ch-88jc-xwx2 high
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters
Affected range
SEMVER: introduced 0; fixed 0.1.13SEMVER: introduced 0.2.0; fixed 1.9.0SEMVER: introduced 0; fixed 0.1.10SEMVER: introduced 7.0.0; fixed 8.0.0SEMVER: introduced 2.0.0; fixed 3.3.0Fixed versions: 0.1.13, 1.9.0, 0.1.10, 8.0.0, 3.3.0, 6.3.0
GHSA-27v5-c462-wpq7 moderate
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards
Affected range
SEMVER: introduced 8.0.0; fixed 8.4.0Fixed versions: 8.4.0