High severity vulnerabilities / `serve-handler` / `path-to-regexp`

[MikeMcC399]

Description

serve@14.2.3 contains 3 high severity vulnerabilities

$ npm audit
# npm audit report

path-to-regexp  0.2.0 - 7.2.0
Severity: high
path-to-regexp outputs backtracking regular expressions - https://github.com/advisories/GHSA-9wv6-86v2-598j
fix available via `npm audit fix --force`
Will install serve@6.5.8, which is a breaking change
node_modules/path-to-regexp
  serve-handler  *
  Depends on vulnerable versions of path-to-regexp
  node_modules/serve-handler
    serve  >=7.0.0
    Depends on vulnerable versions of serve-handler
    node_modules/serve

3 high severity vulnerabilities

due to serve-handler@6.1.5 - current latest version released Nov 1, 2022

$ npm ls path-to-regexp
serve-test@1.0.0
└─┬ serve@14.2.3
  └─┬ serve-handler@6.1.5
    └── path-to-regexp@2.2.1

• See also High severity dependency path-to-regexp serve-handler#211

Please remediate the vulnerabilities!

Library version

14.2.3

Node version

v20.17.0

[MikeMcC399]

Please advise if @vercel is no longer planning to maintain this repo and the dependency https://github.com/vercel/serve-handler repo.

[kmturley]

Adding this to package.json appears to resolve the issue
It may break some functionality as it is a major dependency upgrade

  "overrides": {
    "path-to-regexp": "^8.1.0"
  }

[MikeMcC399]

@kmturley

You might also use the following for npm, which is less likely to break functionality as it uses the lowest version with a (partial) fix:

  "overrides": {
    "serve": {
      "path-to-regexp": "3.3.0"
    }

[lake-effect]

Moved to https://github.com/warren-bank/node-serve, which is a fork without this dependency.

[MikeMcC399]

• See Bump serve-handler, vitest, and typescript #812 for resolution

[AndyBitz]

@MikeMcC399 thank you for filing this issue and @alana-cruickshank for the PR on serve-handler with the fix.

We've just published serve@14.2.4 which includes the fix.