CVE-2024-45296

CVE-2024-45296 is a Denial-of-Service (DoS) vulnerability affecting the path-to-regexp library, specifically versions 0.1 and all other versions prior to 8.0.0. This flaw arises from the generation of inefficient regular expressions when two parameters exist within a single path segment, separated by a non-period character. An attacker can exploit this by crafting malicious input, causing the regex matching to consume excessive CPU resources and block the JavaScript event loop, leading to a denial of service. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high impact on availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.