{"id":"CVE-2024-45813","published":"2024-09-18T16:47:57Z","modified":"2024-09-18T18:07:10Z","title":"ReDoS vulnerability in multiparametric routes in find-my-way","vendor":"delvedor","product":"find-my-way","tier":"tail","description":{"text":"find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00681,"percentile":0.52288,"provenance":"source"},"cwes":[{"id":"CWE-1333","name":"Inefficient Regular Expression Complexity"}],"references":[{"url":"https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440","tags":["x_refsource_MISC"]},{"url":"https://blakeembrey.com/posts/2024-09-web-redos","tags":["x_refsource_MISC"]}],"priority":{"score":14.2,"factors":[{"name":"EPSS percentile","points":10.46},{"name":"CVSS severity","points":3.71}]},"vendorSlug":"delvedor","affectedVersions":[{"vendor":"delvedor","product":"find-my-way","versions":["< 8.2.2","= 9.0.0"]}],"affected":[{"ecosystem":"npm","package":"find-my-way","vulnerableRanges":[">=5.5.0, <8.2.2",">=9.0.0, <9.0.1"],"patched":["8.2.2","9.0.1"],"from":["GHSA-rrr8-f88r-h8q6"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2867","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-pillarjs-path-to-regexp-cve-2024-45296","parents":[{"from":"CVE-2024-45296","to":"CVE-2024-45813","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-rrr8-f88r-h8q6","via":"reference","url":"https://github.com/advisories/GHSA-9wv6-86v2-598j"}]}],"children":[{"from":"CVE-2024-45813","to":"CVE-2026-4867","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-rrr8-f88r-h8q6","via":"reference","url":"https://github.com/advisories/GHSA-9wv6-86v2-598j"}]}],"packageHistory":[{"cve":"CVE-2020-7764","published":"2020-11-08","fixed":"3.0.5","kev":false},{"cve":"CVE-2024-45813","published":"2024-09-18","fixed":"9.0.1","kev":false},{"cve":"CVE-2026-47219","published":"2026-07-28","fixed":"9.7.0","kev":false,"link":{"from":"CVE-2024-45813","to":"CVE-2026-47219","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:find-my-way","fromFixed":"9.0.1","toFixed":"9.7.0","daysApart":678}]}}],"package":"npm:find-my-way"}}