GCVE - cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pillarjs:path-to-regexp:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Pillarjs (`cc447f9a-ae88-52ad-b549-a3fb2cf56894`)
Product	Path To Regexp (`1f9a9be2-82c7-5421-b5e9-db9527381ed1`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
`pkg:github/pillarjs/path-to-regexp`	purl2cpe	2026-06-19 13:12:40.940439
`pkg:npm/path-to-regexp`	purl2cpe	2026-06-19 13:12:40.940442

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-52798`	vulnerable	2026-06-08 06:52:16.253973	path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296. Published: 2024-12-05T22:45:42.774Z Updated: 2025-01-24T20:03:11.852Z Open on db.gcve.eu Reference links https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-45296`	vulnerable	2026-06-08 06:45:55.832022	path-to-regexp outputs backtracking regular expressions HIGH (7.5) path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. Published: 2024-09-09T19:07:40.313Z Updated: 2025-01-24T20:03:07.723Z Open on db.gcve.eu Reference links https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.