Came across something in reactnative-esm/package-lock.json around line 1153 that looked worth flagging.
This finding identifies a Regular Expression Denial of Service (ReDoS) vulnerability in path-to-regexp v8.3.0. When route patterns contain multiple sequential optional groups (e.g., {a}{b}{c}:z), the library's regex compilation generates an exponentially growing pattern due to unbounded quantifier expansion. Malicious or overly complex route definitions can trigger catastrophic CPU consumption, resulting in application hangs or crashes. Risk Level: HIGH. Immediate remediation requires upgrading the package to the patched release where the regex engine has been hardened against exponential backtracking.
Something like this might fix it:
--- a/reactnative-esm/package-lock.json
+++ b/reactnative-esm/package-lock.json
@@ -1153,7 +1153,7 @@
},
{
"name": "path-to-regexp",
- "version": "8.3.0",
+ "version": "8.4.0",
"resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.0.tgz",
"integrity": "sha512-..."
}
```
Implementation Note: Run `npm update path-to-regexp` or `yarn upgrade path-to-regexp@8.4.0` in the project root, then commit the updated lockfile.For reference: rule CVE-2026-4926. Rated high.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Came across something in
reactnative-esm/package-lock.jsonaround line 1153 that looked worth flagging.This finding identifies a Regular Expression Denial of Service (ReDoS) vulnerability in path-to-regexp v8.3.0. When route patterns contain multiple sequential optional groups (e.g., {a}{b}{c}:z), the library's regex compilation generates an exponentially growing pattern due to unbounded quantifier expansion. Malicious or overly complex route definitions can trigger catastrophic CPU consumption, resulting in application hangs or crashes. Risk Level: HIGH. Immediate remediation requires upgrading the package to the patched release where the regex engine has been hardened against exponential backtracking.
Something like this might fix it:
For reference: rule
CVE-2026-4926. Rated high.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.