High severity vulnerabilities / serve-handler / path-to-regexp

[MikeMcC399]

Description

[email protected] contains 3 high severity vulnerabilities

$ npm audit
# npm audit report

path-to-regexp  0.2.0 - 7.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/path-to-regexp
  serve-handler  *
  Depends on vulnerable versions of path-to-regexp
  node_modules/serve-handler
    serve  >=7.0.0
    Depends on vulnerable versions of serve-handler
    node_modules/serve

3 high severity vulnerabilities

due to [email protected] - current latest version released Nov 1, 2022

$ npm ls path-to-regexp
[email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected]

• See also High severity dependency path-to-regexp serve-handler#211

Please remediate the vulnerabilities!

Library version

14.2.3

Node version

v20.17.0

[MikeMcC399]

Please advise if @vercel is no longer planning to maintain this repo and the dependency https://github.com/vercel/serve-handler repo.

[kmturley]

Adding this to package.json appears to resolve the issue
It may break some functionality as it is a major dependency upgrade

  "overrides": {
    "path-to-regexp": "^8.1.0"
  }

[MikeMcC399]

@kmturley

You might also use the following for npm, which is less likely to break functionality as it uses the lowest version with a (partial) fix:

  "overrides": {
    "serve": {
      "path-to-regexp": "3.3.0"
    }

[lake-effect]

Moved to https://github.com/warren-bank/node-serve, which is a fork without this dependency.

[MikeMcC399]

• See Bump serve-handler, vitest, and typescript #812 for resolution

[AndyBitz]

@MikeMcC399 thank you for filing this issue and @alana-cruickshank for the PR on serve-handler with the fix.

We've just published [email protected] which includes the fix.

[MikeMcC399]

@AndyBitz

Thank you for sorting out these issues!