All the vulnerabilities related to the version 10.4.7 of the package
path-to-regexp contains a ReDoS
The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp
, originally reported in CVE-2024-45296
Upgrade to 0.1.12.
Avoid using two parameters within a single path segment, when the separator is not .
(e.g. no /:a-:b
). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.