[Backport 2.17] fix path-to-regex cve

[Backport 2.17] fix path-to-regex cve #11256