path-to-regexp: security fix record
SEEDED – NOT A REAL ADVISORY
Fixed versions of path-to-regexp for the affected release lines, each released by CI with its proof results and a signed attestation. This page tracks how far the fix has reached.
Is everyone safe yet?
Yes. Every tracked consumer is safe.
Closed. Time-to-safe 1 h 14 min, from the advisory to the last safe consumer.
Release lines: 5 of 5 released
- 0.1.xreleased0.1.10-pw.20261021105740
- 1.xreleased1.8.1-pw.20261021105933
- 3.xreleased3.2.1-pw.20261021110110
- 6.xreleased6.2.3-pw.20261021110455
- 7.x (master)released7.1.1-pw.20261021110631
reach:Consumers: 3 of 3 safe, each under the line it uses
- express4safe
- v1safe
- v6safe
Which version should you use?
Each line is proved in two places. The repro fails on the commit before the fix, when the campaign is planned. Then, in the line's merge request pipeline, the repro passes, the full test suite passes, the public API is unchanged, and a ReDoS check finds no backtracking. A proof the line's policy skips is named as not run.
| Line | Affected | Status | Proofs | What to do | Evidence |
|---|---|---|---|---|---|
| 0.1.x | versions before 0.1.10-pw.20261021105740 | released | passedall 4 proofs | Install 0.1.10-pw.20261021105740 | |
| 1.x | versions before 1.8.1-pw.20261021105933 | released | passedall 4 proofs | Install 1.8.1-pw.20261021105933 | |
| 3.x | versions before 3.2.1-pw.20261021110110 | released | passedall 4 proofs | Install 3.2.1-pw.20261021110110 | |
| 6.x | versions before 6.2.3-pw.20261021110455 | released | passedall 4 proofs | Install 6.2.3-pw.20261021110455 | |
| 7.x (master) | versions before 7.1.1-pw.20261021110631 | released | passed3 of 4; ReDoS check not run | Install 7.1.1-pw.20261021110631 |
Tracked consumers
Projects in this GitLab group that depend on the library. Projects outside GitLab are not tracked here.
| Consumer | Upgrade | Status |
|---|---|---|
| consumer-express4 | 0.1.9 to 0.1.10-pw.20261021105740 | safe |
| consumer-v1 | 1.8.0 to 1.8.1-pw.20261021105933 | safe |
| consumer-v6 | 6.2.2 to 6.2.3-pw.20261021110455 | safe |
Verify a release
Each release carries its SBOM and a cosign attestation. Its notes give the exact command and the values for each placeholder below, with the signing identity pinned to that line's CI pipeline on the release tag.
cosign verify-blob-attestation \
--bundle <bundle> --type <type> \
--certificate-identity '<identity>' \
--certificate-oidc-issuer \
https://gitlab.com <package.tgz>