http-cache-semantics vulnerable to Regular Expression Denial of Service [Severity High]

[plsdev89]

I am using [email protected] and getting below security alert.

Dependabot cannot update http-cache-semantics to a non-vulnerable version
The latest possible version that can be installed is 3.8.1 because of the following conflicting dependencies:

[email protected] requires [email protected] via a transitive dependency on [email protected]
[email protected] requires [email protected] via a transitive dependency on [email protected]

The earliest fixed version is 4.1.1.