GitHub Advisoryadvisory · npm

GHSA-w4pp-8pjf-rmxw pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

HIGH Published 2026-05-26 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-9496
Ecosystem
npm
Packages
pacote
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333, CWE-400
Reviewed
2026-08-27

Affected packages

• npm pacote: >= 11.2.7, < 21.5.1 → fixed in 21.5.1

Description

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Related

Alias · CVE (1)

  • CVE-2026-9496 Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. vulnerability

Weakness · CWE (2)

  • CWE-1333 Inefficient Regular Expression Complexity weakness
  • CWE-400 Uncontrolled Resource Consumption weakness

References