Impact:
When using multiple wildcards, combined with at least one parameter, a regular expression can be generated that is vulnerable to ReDoS. This backtracking vulnerability requires the second wildcard to be somewhere other than the end of the path.
Unsafe examples:
/*foo-*bar-:baz /*a-:b-*c-:d /x/*a-:b/*c/y
Safe examples:
/*foo-:bar /*foo-:bar-*baz
Patches:
Upgrade to version 8.4.0.
Workarounds:
If you are using multiple wildcard parameters, you can check the regex output with a tool such as https://makenowjust-labs.github.io/recheck/playground/ to confirm whether a path is vulnerable.
Weakness
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Path-to-regexp | Pillarjs | 8.0.0 (including) | 8.4.0 (excluding) |
| Red Hat Developer Hub 1.10 | RedHat | rhdh/rhdh-hub-rhel9:1780930740 | * |
| Node-path-to-regexp | Ubuntu | esm-apps/xenial | * |
| Node-path-to-regexp | Ubuntu | upstream | * |