Vulnerability	Vulnerable Version
M Regular Expression Denial of Service (ReDoS) Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when including multiple regular expression parameters in a single segment, which will produce the regular expression `/^\/([^\/]+?)-([^\/]+?)\/?$/`, if two parameters within a single segment are separated by a character other than a `/` or `.`. Poor performance will block the event loop and can lead to a DoS. Note: While the 8.0.0 release has completely eliminated the vulnerable functionality, prior versions that have received the patch to mitigate backtracking may still be vulnerable if custom regular expressions are used. So it is strongly recommended for regular expression input to be controlled to avoid malicious performance degradation in those versions. This behavior is enforced as of version 7.1.0 via the `strict` option, which returns an error if a dangerous regular expression is detected. How to fix Regular Expression Denial of Service (ReDoS)? Upgrade `path-to-regexp` to version 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0 or higher.	<0.1.10>=0.2.0 <1.9.0>=2.0.0 <3.3.0>=4.0.0 <6.3.0>=7.0.0 <8.0.0

Regular Expression Denial of Service (ReDoS)

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) when including multiple regular expression parameters in a single segment, which will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/, if two parameters within a single segment are separated by a character other than a / or .. Poor performance will block the event loop and can lead to a DoS.

Note: While the 8.0.0 release has completely eliminated the vulnerable functionality, prior versions that have received the patch to mitigate backtracking may still be vulnerable if custom regular expressions are used. So it is strongly recommended for regular expression input to be controlled to avoid malicious performance degradation in those versions. This behavior is enforced as of version 7.1.0 via the strict option, which returns an error if a dangerous regular expression is detected.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade path-to-regexp to version 0.1.10, 1.9.0, 3.3.0, 6.3.0, 8.0.0 or higher.

<0.1.10>=0.2.0 <1.9.0>=2.0.0 <3.3.0>=4.0.0 <6.3.0>=7.0.0 <8.0.0

Go back to all versions of this package