Alerts This Week
Warning Icon 1 606
Alerts This Week
Warning Icon 1 606

Ubuntu 24.04 Path-to-Regexp Significant Denial-of-Service Flaw USN-8290-1

ubuntu
Calendar Grey May 22, 2026
Dist Ubuntu Esm H88
Path-to-Regexp on Ubuntu can crash upon receiving crafted traffic. Keep your system updated to prevent DoS.
Path-to-Regexp could be made to crash if it received specially crafted network traffic.

Summary

Path-to-Regexp could be made to crash if it received specially crafted

network traffic.

Software Description:

- node-path-to-regexp: Turn a path string such as /user/:name into a regular expression.

Details:

It was discovered that Path-to-Regexp incorrectly handled route patterns

containing multiple named parameters separated by non-delimiter characters

such as hyphens. An attacker could possibly use this issue to cause a denial

of service via catastrophic backtracking in the generated regular expressions.

Topics%20covered

Topics Covered

security advisory denial of service DoS Ubuntu important node-path-to-regexp

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  node-path-to-regexp             6.2.1-1ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 22.04 LTS
  node-path-to-regexp             6.2.0-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 20.04 LTS
  node-path-to-regexp             6.1.0-2ubuntu0.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  node-path-to-regexp             1.0.1-1ubuntu0.18.04.1~esm1
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  node-path-to-regexp             1.0.1-1ubuntu0.16.04.1~esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-8290-1

CVE-2024-45296

Severity
important
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-8290-1

Topics%20covered

Topics Covered

security advisory denial of service DoS Ubuntu important node-path-to-regexp

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here