-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a ReDoS (Regular Expression Denial of Service) in the path-to-regexp library. The provided commit f01c26a013b1889f0c217c643964513acf17f6a4 directly patches the index.js file. The core logic change occurs within the pathToRegexp function. This function takes a path string and converts it into a regular expression. The patch modifies how this conversion happens, specifically how the backtrack variable is handled and how the pos (position) variable is updated within the callback of a path.replace call. These changes are intended to prevent the generation of regular expressions that are susceptible to catastrophic backtracking. Therefore, the pathToRegexp function is the primary function involved in the vulnerability, as it's responsible for generating the problematic regular expressions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| path-to-regexp | npm | < 0.1.12 | 0.1.12 |