Spotted what might be an issue in pnpm-lock.yaml around line 1.
The project uses path-to-regexp 6.1.0, which can generate malicious regular expressions when a URL segment contains two parameters separated by a non‑dot character. This leads to catastrophic backtracking, causing high CPU usage and blocking the Node.js event loop, resulting in a denial‑of‑service. The issue is classified as HIGH severity (CVE‑2024‑45296). Upgrading to a patched version (≥6.3.0 or the latest 8.x) eliminates the vulnerable regex generation.
Something like this might fix it:
*** Begin Patch
*** Update File: pnpm-lock.yaml
@@
- path-to-regexp@6.1.0:
- resolution:
- integrity: sha512-<old‑hash>
- dependencies:
- # ... other deps ...
+ path-to-regexp@6.3.0:
+ resolution:
+ integrity: sha512-<new‑hash>
+ dependencies:
+ # ... other deps ...
*** End Patch
# Additionally, ensure the package.json references a safe version:
# "path-to-regexp": "^6.3.0" # or "^8.0.0" for the latest major release
# After editing, run `pnpm install` to regenerate the lockfile.
For reference: rule CVE-2024-45296. Rated high.
The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
pnpm-lock.yamlaround line 1.The project uses path-to-regexp 6.1.0, which can generate malicious regular expressions when a URL segment contains two parameters separated by a non‑dot character. This leads to catastrophic backtracking, causing high CPU usage and blocking the Node.js event loop, resulting in a denial‑of‑service. The issue is classified as HIGH severity (CVE‑2024‑45296). Upgrading to a patched version (≥6.3.0 or the latest 8.x) eliminates the vulnerable regex generation.
Something like this might fix it:
For reference: rule
CVE-2024-45296. Rated high.The suggested change is untested against this project, so please read it before applying it.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.