vercel/serve-handler

High severity vulnerabilities / serve-handler / path-to-regexp path-to-regexp-2.2.1.tgz

SrideviE50254 opened this issue · 5 comments

SrideviE50254 commented

Hello Team,

Mend Bolt tool is showing vulnerability in package "path-to-regexp-2.2.1.tgz" with [CVE-2024-45296]

Vulnerability is raised from the path-to-regexp@2.2.1 module which is used as a transitive dependency. The recommended version of this is 8.1.0

Running npm list path-to-regexp returns the following:

└─┬ serve@14.2.3
└─┬ serve-handler@6.1.5
└── path-to-regexp@2.2.1

Could you please upgrade the path-to-regexp transitive dependency to 8.1.0 to fix it at asap.

Regards,
Sridevi G

kmturley commented

Adding this to package.json appears to resolve the issue
It may break some functionality as it is a major dependency upgrade

  "overrides": {
    "path-to-regexp": "^8.1.0"
  }
thomashohn commented

Should also be fixed in path-to-regexp 3.3.0 - might be less "agressive"

  • 👍3
SrideviE50254 commented

Mend bolt is suggesting to upgrade the version 0.1.10 or 8.0.0
MendSS

Kindly refer attached screenshot for more details.

Thanks
Sridevi.G

cylewaitforit commented

This is a duplicate of #211. @SrideviE50254 Please take the time to check open issues before creating a new one.

  • 👍1
SrideviE50254 commented

Hi @cylewaitforit,

Thank you for informing me about the duplicate issue. In the future, I will check the existing tickets before creating a new one. I referred to the issue you linked, #211.

I am using the same versions of Serve and Serve Handler:

└─┬ serve@14.2.3
└─┬ serve-handler@6.1.5
└── path-to-regexp@2.2.1

However, Mend Bolt is suggesting version 0.1.10 or 8.0.0 for path-to-regexp.

Mend-bolt

This still doesn't resolve my problem. Should I continue the discussion here or in the reference task you mentioned?

Thank you
Sridevi G