Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

find-my-way router can be crashed by crafted URL

CVE-2024-45813 · published 2 years ago
Summary

The find-my-way HTTP router can generate a harmful pattern when a URL contains two placeholders in the same segment followed by a hyphen, such as "/:a-:b-". This can cause the router to become unresponsive, effectively a denial of service. Update to version 8.2.2, 9.0.1, or any later release to fix the issue.

What to do
  • Update matteo.collina find-my-way to version 9.0.1.
  • Update matteo.collina find-my-way to version 8.2.2.
Affected software
Ecosystem VendorProductAffected versions
npm matteo.collina find-my-way >= 9.0.0, < 9.0.1
>= 5.5.0, < 8.2.2
Fix: upgrade to 9.0.1
Original advisory text
ReDoS vulnerability in multiparametric routes in find-my-way
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-1333Inefficient Regular Expression Complexity (ReDoS)
Timeline
Published18 Sep 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rrr8-f88r-h8q6 · GHSA
CVE-2024-45813 · NVD
CVE-2024-45813 · OSV
Track software like this
Free during beta