Public dependency advisories for ws and path-to-regexp

[gateway]

There are public npm/GitHub advisories currently showing against resolved Playwright repository dependencies. I am filing this issue first per the contribution guidelines, rather than reopening the dependency PR directly.

This is not a report of a new private Playwright vulnerability and I am not claiming active exploitation in Playwright. The concern is that the repo currently resolves package versions that are covered by public advisories, and maintainers may want to decide whether these should be updated.

Packages flagged

ws@8.17.1

ws is listed in the root package.json dependency set and resolves to 8.17.1 in package-lock.json.

Public advisories:

• GHSA-96hv-2xvq-fx4p: memory exhaustion denial of service in ws
• GHSA-58qx-3vcg-4xpx: uninitialized memory disclosure in ws

Why it may matter here:

• ws appears to be used by Playwright server/runtime-related code paths, including websocket/transport utilities.
• If any affected code path processes attacker-controlled websocket payloads in a relevant environment, these advisory classes can matter.
• I am not asserting exploitability in Playwright; I am surfacing the dependency state for maintainer triage.

Potential remediation:

• Update ws from 8.17.1 to a patched 8.x release, for example 8.21.0.

path-to-regexp@8.3.0

path-to-regexp resolves through the lockfile as a transitive dependency, via router.

Public advisory:

• GHSA-j3q9-mxjg-w52f / CVE-2026-4926: denial of service / ReDoS class issue in path-to-regexp

Why it may matter here:

• The package is transitive rather than directly imported from Playwright source in my quick review.
• The risk depends on whether untrusted route patterns or matching inputs can reach the affected dependency path.
• This may simply be dependency hygiene if that path is not used in a security-relevant runtime flow.

Potential remediation:

• Refresh the lockfile so path-to-regexp resolves to a patched version, for example 8.4.2.

Prior patch

I previously opened #41446 with a narrow dependency-only diff:

• ws: 8.17.1 -> 8.21.0
• path-to-regexp: 8.3.0 -> 8.4.2
• changed only package.json and package-lock.json
• npm audit --json no longer reported the high-severity ws or path-to-regexp findings after the update

That PR was closed with a request to start with an issue, so I am moving the discussion here.

Question for maintainers

Would you like this handled as:

• a maintainer-owned dependency update,
• a community PR based on the prior narrow diff,
• a smaller ws-only PR,
• or no action because these dependencies are not security-relevant in Playwright's shipped/runtime surface?

If a PR is welcome, I can prepare one that follows the path you prefer.

[pavelfeldman]

Thanks! I wonder why dependapot is sleeping behind the wheel.

[gateway]

Thanks! I wonder why dependapot is sleeping behind the wheel.

Yea im not sure why.. I use Playwrite a lot but I also build out my guardian codex scanner plugging that scans my local projects checking my python or node papckages for potential exploits or potential issues and this was flagged by my system. So it goes and pulls down the full repo and verifies this .. just wanted to surface this for you and thats why i originally submitted a PR for it.