GHSA-rhx6-c78j-4q9w: path-to-regexp fixed in 0.1.12

GHSA-rhx6-c78j-4q9w PUBLISHED CVSS 7.5 HIGH

path-to-regexp contains a ReDoS

Record from GitHub Advisory Database · Published December 5, 2024

path-to-regexp is fixed in 0.1.12 (npm)

path-to-regexp contains a ReDoS

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
path-to-regexp	npm	0.1.12
kubeflow-pipelines	Wolfi	2.3.0-r3
tileserver-gl	Wolfi	5.1.1-r0
kubeflow-centraldashboard	Wolfi	1.9.2-r3
grafana-image-renderer	Wolfi	3.11.6-r2
argo-workflows	Chainguard	3.6.2-r1
argo-workflows	Wolfi	3.6.2-r1
sqlpad	Chainguard	7.5.2-r0
tileserver-gl	Chainguard	5.1.1-r0
arangodb-3.11	Chainguard	3.11.14.4-r11
thingsboard	Chainguard	3.8.1-r4
kubeflow-pipelines	Chainguard	2.3.0-r3

5 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
npm	path-to-regexp	0
wolfi	kubeflow-pipelines	0
wolfi	tileserver-gl	0
wolfi	kubeflow-centraldashboard	0
wolfi	grafana-image-renderer	0
chainguard	argo-workflows	0
wolfi	argo-workflows	0
chainguard	sqlpad	0
chainguard	tileserver-gl	0
chainguard	arangodb-3.11	0
chainguard	thingsboard	0
chainguard	kubeflow-pipelines	0
chainguard	grafana-image-renderer	0
chainguard	tileserver-gl-fips	0
wolfi	thingsboard	0
wolfi	sqlpad	0
chainguard	kubeflow-centraldashboard	0

Timeline

Dec 5, 2024 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-rhx6-c78j-4q9w
vulnetix vdb fixes GHSA-rhx6-c78j-4q9w

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-rhx6-c78j-4q9w/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →