fix(lib): polynomial redos

fastify · Oct 28, 2023 · d26d6a2 · d26d6a2
1 parent 45ab836
commit d26d6a2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/spec/openapi/utils.js b/lib/spec/openapi/utils.js
@@ -88,7 +88,7 @@ function normalizeUrl (url, serverUrls, stripBasePath) {
 
 function resolveServerUrls (servers) {
   const resolvedUrls = []
-  const findVariablesRegex = /\{(.*?)\}/gu // As for OpenAPI v3 spec url variables are named in brackets, e.g. {foo}
+  const findVariablesRegex = /\{([^{}]+)\}/gu // As for OpenAPI v3 spec url variables are named in brackets, e.g. {foo}
 
   servers = Array.isArray(servers) ? servers : []
   for (const server of servers) {