{"id":"CVE-2024-45813","aliases":["GHSA-rrr8-f88r-h8q6"],"url":"https://o3.security/vulnerability/CVE-2024-45813","summary":"ReDoS vulnerability in multiparametric routes in  find-my-way","details":"find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.","published":"2024-09-18T16:47:57.138Z","modified":"2026-08-08T03:48:07.254644415Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"find-my-way","fixedVersion":"8.2.2"},{"ecosystem":"npm","name":"find-my-way","fixedVersion":"9.0.1"}],"fix":{"url":"https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440","label":"delvedor/find-my-way@5e9e0eb"},"references":[{"type":"WEB","url":"https://blakeembrey.com/posts/2024-09-web-redos"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45813.json"},{"type":"ADVISORY","url":"https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45813"},{"type":"FIX","url":"https://github.com/delvedor/find-my-way/commit/5e9e0eb5d8d438e06a185d5e536a896572dd0440"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:48:07.254644415Z"}}