CVE-2024-45296 — path-to-regexp outputs backtracking regular expressions

Affected: pillarjs path-to-regexp

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

GHSA-23c5-xmqv-rm74 — minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

Affected: npm: minimatch

### Summary

Nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally.

---

### Details

The root cause is in `AST.toRegExpSource()` at [`src/ast.ts#L598`](https://github.com/isaacs/minimatch/blob/v10.2.2/src/ast.ts#L598). For the `*` extglob type, the close token emitted is `)*` or `)?`, wrapping the recursive body in `(?:...)*`. When extglobs are nested, each level adds another `*` quantifier around the previous group:

```typescript : this.type === '*' && bodyDotAllowed ? `)?` : `)${this.type}` ```

This produces the following regexps:

| Pattern | Generated regex | |----------------------|------------------------------------------| | `*(a\|b)` | `/^(?:a\|b)*$/` | | `*(*(a\|b))` | `/^(?:(?:a\|b)*)*$/` | | `*(*(*(a\|b)))` | `/^(?:(?:(?:a\|b)*)*)*$/` | | `*(*(*(*(a\|b))))` | `/^(?:(?:(?:(?:a\|b)*)*)*)*$/` |

These are textbook nested-quantifier patterns. Against an input o…

Most recent entries from all

CVE-2024-45296 — path-to-regexp outputs backtracking regular expressions

GHSA-23c5-xmqv-rm74 — minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions