{"id":"UBUNTU-CVE-2024-52798","details":"path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgrade to 0.1.12. This vulnerability exists because of an incomplete fix for CVE-2024-45296.","modified":"2026-05-21T12:15:26.891693174Z","published":"2024-12-05T23:15:00Z","withdrawn":"2026-05-21T12:01:27Z","upstream":["CVE-2024-52798"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2024-52798"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2024-52798"},{"type":"REPORT","url":"https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w"},{"type":"REPORT","url":"https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4"}],"affected":[{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.0.1-1","binary_name":"node-path-to-regexp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.0.1-1","binary_name":"node-path-to-regexp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.0-2","3.1.0-1","6.1.0-2"],"ecosystem_specific":{"binaries":[{"binary_version":"6.1.0-2","binary_name":"node-path-to-regexp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1","6.2.0-2"],"ecosystem_specific":{"binaries":[{"binary_version":"6.2.0-2","binary_name":"node-path-to-regexp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.1-1"],"ecosystem_specific":{"binaries":[{"binary_version":"6.2.1-1","binary_name":"node-path-to-regexp"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-express","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/node-express?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.0+~cs8.36.26-2","4.21.2+~cs8.36.27-1","4.21.2+~cs8.36.27-2"],"ecosystem_specific":{"binaries":[{"binary_name":"node-express","binary_version":"4.21.2+~cs8.36.27-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"node-path-to-regexp","binary_version":"6.3.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-express","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/node-express?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.21.2+~cs8.36.27-2","4.21.2+~cs8.36.27-3","5.1.0+~cs12.3.3-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"node-express","binary_version":"5.1.0+~cs12.3.3-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}},{"package":{"name":"node-path-to-regexp","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/node-path-to-regexp?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.3.0-1","8.3.0-1","8.4.0-1"],"ecosystem_specific":{"binaries":[{"binary_name":"node-path-to-regexp","binary_version":"8.4.0-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-52798.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"type":"Ubuntu","score":"medium"}]}