{"action":"Upgrade path-to-regexp to 0.1.10 or later.","affected":[{"fixed":"1.9.0","introduced":"0.2.0"},{"fixed":"0.1.10","introduced":"0"},{"fixed":"8.0.0","introduced":"7.0.0"},{"fixed":"3.3.0","introduced":"2.0.0"},{"fixed":"6.3.0","introduced":"4.0.0"}],"component":"path-to-regexp","cve_ids":["CVE-2024-45296","CVE-2026-4867"],"ecosystem":"npm","epss":0.00932,"exploited":false,"fixed_versions":["1.9.0","0.1.10","8.0.0","3.3.0","6.3.0"],"ghsa_id":"GHSA-9wv6-86v2-598j","id":"tcs_01M5KFH6GEP4QHFP1D2KJV0JYR","modified_at":"2026-09-10T03:50:18.832560863Z","published_at":"2024-09-09T20:19:15Z","references":["https://osv.dev/vulnerability/GHSA-9wv6-86v2-598j","https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j","https://nvd.nist.gov/vuln/detail/CVE-2024-45296","https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f","https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6","https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485","https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef","https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894","https://github.com/pillarjs/path-to-regexp","https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0","https://security.netapp.com/advisory/ntap-20250124-0001"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9wv6-86v2-598j","url":"https://osv.dev/vulnerability/GHSA-9wv6-86v2-598j"}],"summary":"path-to-regexp outputs backtracking regular expressions"}