build(deps): update dependency path-to-regexp to v1 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
path-to-regexp	0.2.5 → 1.9.0

---

path-to-regexp outputs backtracking regular expressions

CVE-2024-45296 / GHSA-9wv6-86v2-598j

More information

Details

Impact

A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b.

Patches

For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

These versions add backtrack protection when a custom regex pattern is not provided:

• 0.1.10
• 1.9.0
• 3.3.0
• 6.3.0

They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.

Version 7.1.0 can enable strict: true and get an error when the regular expression might be bad.

Version 8.0.0 removes the features that can cause a ReDoS.

Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b to /:a-:b([^-/]+).

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.

Details

Using /:a-:b will produce the regular expression /^\/([^\/]+?)-([^\/]+?)\/?$/. This can be exploited by a path such as /a${'-a'.repeat(8_000)}/a. OWASP has a good example of why this occurs, but the TL;DR is the /a at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the :a-:b on the repeated 8,000 -a.

Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.

References

• OWASP
• Detailed blog post

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f
• https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6
• https://nvd.nist.gov/vuln/detail/CVE-2024-45296
• https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485
• https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef
• https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894
• https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0
• https://security.netapp.com/advisory/ntap-20250124-0001
• https://github.com/advisories/GHSA-9wv6-86v2-598j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pillarjs/path-to-regexp (path-to-regexp)

v1.9.0: Fix backtracking in 1.x

Compare Source

Fixed

• Add backtrack protection to 1.x release (#​320) 925ac8e
• Fix re.exec(&#​39;/test/route&#​39;) result (#​267) 32a14b0

v1.8.0: Backport token to function options

Compare Source

Added

• Backport TokensToFunctionOptions

v1.7.0

Compare Source

• Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations

v1.6.0

Compare Source

• Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
• Allow a delimiter option to be passed in with parse
• Updated TypeScript definition with Keys and Options updated

v1.5.3

Compare Source

• Add \\ to the ignore character group to avoid backtracking on mismatched parens

v1.5.2

Compare Source

• Escape \\ in string segments of regexp

v1.5.1

Compare Source

• Add index.d.ts to NPM package

v1.5.0

Compare Source

• Handle partial token segments (better)
• Allow compile to handle asterisk token segments

v1.4.0

Compare Source

• Handle RegExp unions in path matching groups

v1.3.0

Compare Source

• Clarify README language and named parameter token support
• Support advanced Closure Compiler with type annotations
• Add pretty paths options to compiled function output
• Add TypeScript definition to project
• Improved prefix handling with non-complete segment parameters (E.g. /:foo?-bar)

v1.2.1

Compare Source

• Encode values before validation with path compilation function
• More examples of using compilation in README

v1.2.0

Compare Source

• Add support for matching an asterisk (*) as an unnamed match everything group ((.*))

v1.1.1

Compare Source

• Expose methods for working with path tokens

v1.1.0

Compare Source

• Expose the parser implementation to consumers
• Implement a compiler function to generate valid strings
• Huge refactor of tests to be more DRY and cover new parse and compile functions
• Use chai in tests
• Add .editorconfig

v1.0.3

Compare Source

• Optimised function runtime
• Added files to package.json

v1.0.2

Compare Source

• Use Array.isArray shim
• Remove ES5 incompatible code
• Fixed repository path
• Added new readme badges

v1.0.1

Compare Source

• Ensure installation works correctly on 0.8

v1.0.0

Compare Source

• No more API changes

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.