chore(monorepo): update pnpm-workspace.overrides path-to-regexp to >=0.1.13 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
path-to-regexp	>=0.1.12 → >=0.1.13

---

path-to-regexp contains a ReDoS

CVE-2024-52798 / GHSA-rhx6-c78j-4q9w

More information

Details

Impact

The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296

Patches

Upgrade to 0.1.12.

Workarounds

Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.

References

• GHSA-9wv6-86v2-598j
• https://blakeembrey.com/posts/2024-09-web-redos/

Severity

• CVSS Score: 7.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P

References

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w
• https://blakeembrey.com/posts/2024-09-web-redos
• https://nvd.nist.gov/vuln/detail/CVE-2024-52798
• https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4
• https://security.netapp.com/advisory/ntap-20250124-0002
• https://github.com/advisories/GHSA-rhx6-c78j-4q9w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters

CVE-2026-4867 / GHSA-37ch-88jc-xwx2

More information

Details

Impact

A bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.

Patches

Upgrade to path-to-regexp@0.1.13

Custom regex patterns in route definitions (e.g., /:a-:b([^-/]+)-:c([^-/]+)) are not affected because they override the default capture group.

Workarounds

All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change /:a-:b-:c to /:a-:b([^-/]+)-:c([^-/]+).

If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length.

References

• GHSA-9wv6-86v2-598j
• Detailed blog post: ReDoS the web

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2
• https://nvd.nist.gov/vuln/detail/CVE-2026-4867
• https://blakeembrey.com/posts/2024-09-web-redos
• https://cna.openjsf.org/security-advisories.html
• https://github.com/advisories/GHSA-9wv6-86v2-598j
• https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13
• https://github.com/advisories/GHSA-37ch-88jc-xwx2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pillarjs/path-to-regexp (path-to-regexp)

v0.1.13

Compare Source

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.