CVE-2024-41655: (ReDoS) Regular Expression Denial of Service in tf2-item-format

The core vulnerability stems from src/shared/decomposeName.ts lines 54-57 where user-controlled input (toRemove) is used to create a dangerous regex pattern. This was patched by replacing the regex with string.replace() calls. The getItemIfTarget function enables exploitation by allowing user input to control the toRemove value. Supporting evidence comes from: 1) The security advisory explicitly identifying decomposeName.ts 2) The PoC showing how user input flows through getItemIfTarget 3) Commit diff showing regex removal in decomposeName.ts 4) CWE-1333 mapping to inefficient regex patterns. Other modified functions showed vulnerable regex patterns but were secondary to the main attack vector.