CVE-2024-45813

What it actually does

The flaw is a denial-of-service condition in the find-my-way HTTP router caused by generation of an inefficient regular expression when an application registers a route segment containing two parameters and a trailing hyphen, such as `/:a-:b-`. If that vulnerable route shape exists, specially crafted HTTP paths may cause excessive regular-expression processing during route matching, consuming CPU/event-loop time and reducing availability. The issue is remotely reachable over the network, requires no authentication or user interaction, and affects availability only; it does not directly expose data or allow code execution.

Why it matters to the business

Applications using affected versions of find-my-way may become slow or temporarily unavailable if they define vulnerable route patterns and receive crafted traffic. Because find-my-way is commonly used in Node.js web stacks and frameworks, the risk is most relevant for internet-facing APIs and services where request floods or repeated crafted paths could degrade service reliability, trigger autoscaling costs, cause failed transactions, or create operational incidents. The CVSS score is moderate and EPSS is low, and the issue is not in CISA KEV and has no known mature exploitation, but the publication age means fixed versions have been available for a long time and remediation should be handled through routine dependency patching.

How an attack unfolds

An attacker first identifies an application using a vulnerable version of find-my-way or a framework that embeds it, then probes exposed routes looking for behavior consistent with route patterns that contain multiple parameters in a single path segment separated by hyphens and ending in a hyphen. If such a route exists, the attacker sends crafted URL paths that force the generated regular expression into expensive matching behavior. Repeating those requests can tie up the Node.js event loop or consume CPU on application workers, causing high latency, request timeouts, health-check failures, or process restarts. Exploitation does not require credentials and does not require compromising the host; impact depends on whether the application actually registers the vulnerable route shape.

How to fix it

Upgrade find-my-way to a fixed release: v8.2.2, v9.0.1, or any later version. If pinning by source commit, use a version containing commit `9e666a1170c7e2024ca18ee63da82a72b68a8006` or later. Regenerate lockfiles and redeploy all services that bundle the affected dependency, including transitive uses through web frameworks. There are no known complete workarounds. As temporary risk reduction before patching, review route definitions and avoid patterns with two parameters in one segment followed by a trailing hyphen, such as `/:a-:b-`; place rate limits, request timeouts, and upstream request-size limits in front of affected services; and ensure Node.js worker/process supervision can recover from CPU-bound stalls.

How to confirm the fix worked

Confirm dependency remediation by inspecting package manifests and lockfiles for `find-my-way` versions and verifying deployed artifacts contain v8.2.2, v9.0.1, or later. Use software composition analysis, `npm ls find-my-way`, lockfile review, container image scanning, and build provenance checks to identify both direct and transitive copies. Search application route definitions for vulnerable patterns with multiple parameters in one path segment and a trailing hyphen. In staging, exercise routes that previously matched this pattern and monitor CPU usage, event-loop delay, request latency, and timeout rates before and after upgrade. Confirm production exposure is reduced by verifying updated images or packages are running, old containers/processes have been replaced, and no vulnerable copies remain in deployed bundles.

Typical attack path

1. Identify a Node.js HTTP service or framework likely to use find-my-way for routing.
2. Send reconnaissance requests to infer route behavior, especially endpoints with hyphen-separated path parameters.
3. Target a route pattern equivalent to a segment with two parameters and a trailing hyphen, such as `/:a-:b-`.
4. Send crafted path strings designed to trigger expensive regular-expression evaluation during route matching.
5. Repeat or parallelize requests to consume CPU or block the event loop.
6. Cause degraded response times, request timeouts, failed health checks, or temporary service unavailability.

How to detect it

To determine whether exploitation may have occurred, review HTTP access logs, reverse-proxy logs, CDN/WAF telemetry, APM traces, and application logs for periods of unexplained latency or CPU spikes on services using affected find-my-way versions. Focus on requests to endpoints with hyphenated path segments and unusually long or repetitive path components, especially where bursts correlate with event-loop delay, worker restarts, health-check failures, upstream gateway timeouts, or elevated 5xx/504 responses. In Node.js telemetry, look for sustained high CPU with low memory growth, increased event-loop lag, request timeout logs, and process-manager restarts without corresponding application errors. Because no public exploit maturity or known threat actor activity is reported and no unique exploit payload is defined, detection should be behavior-based and correlated with exposure: vulnerable dependency version plus vulnerable route shape plus abnormal request patterns and service degradation.

What your security team should do

• Inventory all applications and containers that include `find-my-way`, including transitive dependencies from Node.js web frameworks.
• Prioritize patching internet-facing APIs and high-traffic services to find-my-way v8.2.2, v9.0.1, or later.
• Search codebases for route definitions with two parameters in a single segment and a trailing hyphen, such as `/:a-:b-`, and refactor them where feasible.
• Add or tune rate limiting, request timeouts, circuit breakers, and application health monitoring for services that cannot be patched immediately.
• Monitor for abnormal spikes in CPU, event-loop lag, HTTP 408/429/499/500/502/503/504 responses, and repeated unusual path requests against hyphenated endpoints.
• Ensure dependency scanning gates builds so vulnerable find-my-way versions are not reintroduced through lockfile downgrades or transitive dependency changes.