--- title: "CVE-2024-45296\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2024-45296?format=md keywords: index, follow --- # CVE-2024-45296 Publication date 9 September 2024 Last updated 11 July 2025 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) ## Cvss 3 Severity Score **7.5 · High** [Score breakdown](https://ubuntu.com/security/CVE-2024-45296?format=md#impact-score) Toggle side navigation ## Description path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | node-path-to-regexp | 26.04 LTS resolute | Not affected | | 25.10 questing | Not affected | | 25.04 plucky | Ignored end of life, was needs-triage | | 24.10 oracular | Ignored end of life, was needs-triage | | 24.04 LTS noble | Fixed 6.2.1-1ubuntu0.1~esm1 Ubuntu Pro | | 22.04 LTS jammy | Fixed 6.2.0-2ubuntu0.1~esm1 Ubuntu Pro | | 20.04 LTS focal | Fixed 6.1.0-2ubuntu0.1~esm1 Ubuntu Pro | | 18.04 LTS bionic | Fixed 1.0.1-1ubuntu0.18.04.1~esm1 Ubuntu Pro | | 16.04 LTS xenial | Fixed 1.0.1-1ubuntu0.16.04.1~esm1 | | node-express | 26.04 LTS resolute | Needs evaluation | | 25.10 questing | Ignored end of life, was needs-triage | | 25.04 plucky | Ignored end of life, was needs-triage | | 24.10 oracular | Not affected | | 24.04 LTS noble | Not affected | | 22.04 LTS jammy | Not affected | | 20.04 LTS focal | Not affected | | 18.04 LTS bionic | Not affected | | 16.04 LTS xenial | Not affected | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ### Get expanded security coverage with Ubuntu Pro Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use. [Get Ubuntu Pro](https://ubuntu.com/pro) [30-day free trial](https://ubuntu.com/pro/free-trial) ## Severity score breakdown CVSS version: CVSS v3.0 **Base score** 7.5 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Privileges required | None | | User interaction | None | | Scope | Unchanged | | Confidentiality impact | None | | Integrity impact | None | | Availability impact | High | * Scores | Parameter | Value | | --- | --- | | Base score | 7.5 · High | | Exploitability score | - | | Impact score | - | **Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45296) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-45296) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2024-45296) * [Debian](https://security-tracker.debian.org/tracker/CVE-2024-45296) ### Related Ubuntu Security Notices (USN) + [USN-8290-1](https://usn.ubuntu.com/USN-8290-1) + Path-to-Regexp vulnerability + 21 May 2026 ### Other references * * * *