CVE-2024-45813

Description

### Impact A bad regular expression is generated any time you have two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. ### Patches Update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. ### Workarounds No known workarounds. ### References - [CVE-2024-45296](https://github.com/advisories/GHSA-9wv6-86v2-598j) - [Detailed blog post about `path-to-regexp` vulnerability](https://blakeembrey.com/posts/2024-09-web-redos/)

How to fix CVE-2024-45813

To remediate CVE-2024-45813, upgrade the affected package to a fixed version below.

• —upgrade to 8.2.2 or later

Is CVE-2024-45813 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• >= 5.5.0, < 8.2.2

CVSS scores

References (8)

• ADVISORYgithub.com/advisories/GHSA-9wv6-86v2-598j
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2024-45813
• PATCHgithub.com/delvedor/find-my-way
• WEBblakeembrey.com/posts/2024-09-web-redos
• WEB