[ankita10119]

Changes

Path parameters are encoded with encodeURIComponent, which leaves . unchanged. When a path parameter is exactly . or .., URL parsing in fetch removes it as a dot segment, so the request (with the Management API token attached) is sent to a different path than the one the method targets. For example, users.getRoles({ id: '..' }) was sent as GET /api/v2/roles instead of GET /api/v2/users/../roles.

• src/lib/runtime.ts: BaseAPI.createFetchParams now validates the request path before building the URL. Any path segment equal to . or .. throws. Since every path parameter is encoded (so it can't contain /) and no static path template contains a dot segment, this one check covers every method on ManagementClient, AuthenticationClient and UserInfoClient without changing generated code.
• src/lib/errors.ts: adds InvalidPathParameterError, exported from the package root.
• The check runs before any middleware, so a rejected call sends no request at all, including the client-credentials token request.
• Values such as ..., a.b, auth0|abc.def and %2e%2e are unaffected (%2e%2e is encoded as %252e%252e). Query-string values are not checked.

No endpoints were added, removed or deprecated. The only behaviour change: a call whose path parameter is exactly . or .. now throws InvalidPathParameterError instead of being sent to a different endpoint.

This release also fixes the auth0/legacy entrypoint in 5.x–7.x, which depends on auth0@^4.37.1. Users get it by refreshing their lockfile (for example, npm update auth0-legacy).

Alternative considered: percent-encoding . as %2E. That doesn't work, because WHATWG URL parsing also treats %2e%2e, .%2e and %2e. as .., so these values are rejected instead. This matches the fix in v7.6.0.

References

• Security advisory: GHSA-h4ph-726g-66fc (CVE-2026-126128)
• Same fix on the main line: feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428 (released in v7.6.0, src/management/core/url/encodePathParam.ts)

Testing

New tests in test/lib/runtime.test.ts:

• .. and . throw InvalidPathParameterError, and no request is sent
• with client credentials, no /oauth/token request is made when the path parameter is rejected
• ... and a.b are still sent normally

Without the runtime.ts change, the three rejection tests fail.

Verified locally:

• npm run lint, npm run build and npm run lint:package pass
• npm run test:ci: 52/52 suites, 1809/1809 tests on Node 18.20.8, 22.19.0 and 24.0.1
• End-to-end check of the built CJS and ESM output against a local HTTP server using Node's built-in fetch (Node 18 and 24): . and .. send nothing; normal IDs are unchanged
• Read-only check against a dev tenant: unpatched 4.37.1 sends users.getRoles({ id: '..' }) to GET /api/v2/roles and gets a 200; the patched build throws and sends nothing. Normal calls (users.getAll, users.get, users.getRoles, roles.getAll, clients.getAll) return the same results on both builds.

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors