CVE-2024-45813: find-my-way ReDoS Vulnerability in Multiparametric Routes
Summary
CVE-2024-45813: find-my-way has a ReDoS vulnerability in multiparametric routes. Affects find-my-way across 2 version ranges.
>= 5.5.0, < 8.2.2
>= 9.0.0, < 9.0.1
Fixed in 8.2.2 or 9.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
find-my-way is a popular routing library for Node.js, designed to efficiently handle route matching and management. It supports multiparametric routes, allowing developers to define routes with multiple parameters in a single segment. However, a specific pattern in route definitions can lead to a Regular Expression Denial of Service (ReDoS) vulnerability, making it susceptible to performance degradation under certain conditions.
Vulnerability Detail
The vulnerability arises from the generation of a bad regular expression when defining routes with two parameters in a single segment, particularly when a hyphen is added at the end (e.g., '/:a-:b-'). This can lead to excessive backtracking in the regex engine, causing significant delays and potentially crashing the application. The impact is severe, as it can allow an attacker to exploit this behavior to degrade service performance, leading to denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.5.0, < 8.2.28.2.2npm install find-my-way@8.2.2 -
>= 9.0.0, < 9.0.19.0.1npm install find-my-way@9.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. The best course of action is to update the package to the fixed versions mentioned above.
Conclusion
The find-my-way package has a critical vulnerability (CVE-2024-45813) that can lead to denial of service due to improper handling of regular expressions in multiparametric routes. It is crucial to update to the latest versions to mitigate this risk and ensure the stability of your application.
See every vulnerability recorded for find-my-way →
FAQ
The vulnerability is a Regular Expression Denial of Service (ReDoS) that occurs when specific route patterns are defined, leading to performance issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The vulnerability can lead to significant performance degradation, making the application unresponsive and potentially crashing it under attack.
Currently, there are no known workarounds to mitigate this specific vulnerability without updating the package.
If an immediate update is not possible, consider reviewing your route definitions to avoid using the vulnerable pattern until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for find-my-way.
