path-to-regexp@2.2.1 vulnerability

[MikeMcC399]

Issue

The following example directories report high severity vulnerabilities due to their transient dependency usage of path-to-regexp@2.2.1:

Check with npm audit:

• examples/config
• examples/start

Check with pnpm audit:

• examples/start-and-pnpm-workspaces/packages

yarn audit shows no issue, however Dependabot reports the vulnerability:

• examples/start-and-yarn-workspaces/packages

Background

• The GitHub Advisory CVE-2024-45296 advises in general to upgrade to path-to-regexp@8.0.0. If a custom regex pattern is not provided, then path-to-regexp@3.3.0 adds backtracking protection as a mitigation path for versions >= 2.0.0, < 3.3.0.

• path-to-regexp@2.2.1 is required by serve-handler@6.1.5 (current latest version release Nov 1, 2022)

• serve-handler@6.1.5 is required by serve@14.1.0 up to the current latest version serve@14.2.3 release Apr 25, 2024.

Issues are open (vercel/serve#811 & vercel/serve-handler#211) requesting remediation, however the corresponding repos have a low level of maintenance activity, so it can't be predicted if / when there might be release updates with vulnerabilities resolved.