Distillation

Date: Aug 7, 2026

• 🟡 (15:09) User asked which path-to-regexp version fixes the vulnerability ("---fixed version?---"). Answer determined: 6.3.0.
• 🟡 (15:09) Available path-to-regexp versions in registry: 6.3.0, 7.0.0, 7.1.0, 7.2.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.4.1, 8.4.2.
• 🟡 (15:09) pnpm-lock.yaml contains three path-to-regexp versions: 6.1.0, 6.2.1, 6.3.0 (lock entries at lines 6348, 6350, 6352; spec references at lines 2788, 2791, 2794).
• 🟡 (15:09) Lockfile at line 5258 shows a package depends on path-to-regexp@6.2.1. Lines 5276-5277 show a package depends on path-to-regexp@6.1.0 (the vulnerable one) and also references alias path-to-regexp-updated: path-to-regexp@6.3.0.
• 🟡 (15:09) Confirmed path-to-regexp@6.3.0 is already in the dependency tree (via @vercel/routing-utils' path-to-regexp-updated alias). Next step: identify which package depends on the vulnerable path-to-regexp@6.1.0 and determine the fix.