Description
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sigstore | sigstore-js | < 3.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | nodejs24 +4 | 1:24.18.0-1.amzn2023.0.1 | ALAS2023-2026-1920 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.16.0-1.24.18.0.1.amzn2023.0.1 | ALAS2023-2026-1920 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.18.0.1.amzn2023.0.1 | ALAS2023-2026-1920 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | pulumi-language-nodejs | 3.248.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @sigstore/verify | >= 3.1.0, < 3.1.1 | 3.1.1 | GHSA-xgjw-pm74-86q4 |
Advisories 1
- ALAS2023-2026-1920 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 24, 2026