Skip to main content

pacote CVE-2026-9496

| EUVDEUVD-2026-31793 HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-05-26 snyk GHSA-w4pp-8pjf-rmxw
Denial Of Service Red Hat N A Pacote Org Webjars Npm
7.7
CVSS 4.0 · Vendor: snyk
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify service that resolves user-supplied package specs
  2. Delivery
    Craft pathological rawSpec triggering ReDoS in addGitSha
  3. Exploit
    Submit spec via PR, API, or registry query
  4. Execution
    Pacote regex backtracks and pegs CPU
  5. Persist
    Event loop stalls, service stops responding
  6. Impact
    Repeat across endpoints for sustained DoS

Vulnerability Assessment

Weakness
CWE
CWE-1333
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires the attacker to supply a controlled spec.rawSpec value that reaches pacote's addGitSha code path - in practice this means the target must be an application, registry frontend, CI job, or analysis service that calls pacote on package specifications taken from untrusted input (PRs, API parameters, uploaded manifests, search queries) rather than a developer running pacote against their own lockfile. No authentication, user interaction, or special configuration is required (CVSS PR:N/UI:N/AT:N), and any deployment running pacote 11.2.7 or later that exposes such a code path is affected. The principal limiting factor is the indirection: pure local CLI use of npm against trusted manifests does not expose the network attack surface that the AV:N rating implies.
Impact

Signals here diverge in a way that matters operationally. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VA:H paints a network-reachable, low-complexity, unauthenticated path to high availability impact, and SSVC reinforces this by marking the technical impact as partial and automatable=yes - meaning a single payload can be reused at scale. However, EPSS is only 0.04% (11th percentile) and the issue is NOT in CISA KEV, which together suggest no observed in-the-wild abuse. The realistic exposure is sharply gated by deployment context: code paths that hand attacker-controlled rawSpec values into pacote (registry frontends, package-analysis SaaS, CI pipelines parsing untrusted PRs) are genuinely at risk, while a developer running npm install on their own lockfile is not. Note also that 'AV:N' is technically accurate only when pacote is invoked on attacker-supplied input over a network boundary - in pure local CLI use the practical attack vector is much narrower, so treat the 7.7 as an upper bound rather than a uniform rating.
Exploit ScenarioDerived

An attacker submits a pull request, a registry-search query, or a package-analysis API call containing a malicious spec.rawSpec string crafted to trigger catastrophic backtracking in addGitSha's regex. When the target service or CI runner invokes pacote to resolve the spec, the Node.js event loop pegs a CPU core and stops servicing other requests until the process is killed or restarted. SSVC notes a POC exists and the attack is automatable, so an adversary can fan the payload out across many endpoints to amplify the outage.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Denial of service in npm's pacote package (versions 11.2.7 and later) allows remote unauthenticated attackers to exhaust CPU by submitting a crafted spec.rawSpec value to the addGitSha function, where vulnerable regex and string-manipulation logic exhibits catastrophic backtracking. CVSS 4.0 scores this 7.7 (high availability impact, no integrity/confidentiality impact) and SSVC labels exploitation as POC with automatable=yes, though EPSS remains low at 0.04% (11th percentile). No active exploitation has been reported and no public exploit identified at time of analysis, but the bug is trivially triggerable wherever pacote parses untrusted package specs.

RemediationAI

Patch available per vendor advisory - upgrade pacote to the fixed release identified in the Snyk advisories at https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084 and https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025 (exact fixed version is not independently confirmed in the data provided, so consult the advisory for the current safe version). Audit transitive dependencies with npm ls pacote and yarn why pacote, since most exposure is indirect through npm, npm-registry-fetch, or build tooling. If patching is blocked, compensating controls should focus on the input boundary: validate and length-cap any user-supplied package spec strings before they reach pacote (reject specs longer than a few hundred characters and those containing repeated

or @ delimiters), enforce per-request CPU/time budgets on package-resolution workers so a single bad spec cannot stall the event loop indefinitely, and isolate resolution in worker threads or subprocess sandboxes with timeouts. Avoid the broad workaround of disabling Git spec support unless your workflow truly does not need it, as that breaks legitimate git+https:// and github: dependencies.

Affected VersionsENISA

pacote 11.2.7 <*
org.webjars.npm:pacote 11.2.7 <*

Affected Packages

npm pacote fix: 21.5.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

pacote is the package-fetching library that underpins the npm CLI and many JavaScript tooling ecosystems - it resolves, extracts, and verifies npm packages including Git-based specifications. The vulnerable code lives in lib/util/add-git-sha.js, where addGitSha applies regex replacement and string concatenation against the raw spec string supplied by a caller. The CWE-1333 classification identifies this as Inefficient Regular Expression Complexity (ReDoS), meaning a pathological input drives the regex engine into exponential or polynomial backtracking. Because pacote is consumed transitively by npm itself, yarn, and any tool that accepts user-controllable package specs (registries, CI runners, dependency-analysis services), the surface area extends well beyond direct users of the library. The org.webjars.npm:pacote CPE indicates the same vulnerable code is also republished through the WebJars Maven distribution channel.

Know when Pacote gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (snyk) PRIMARY 7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

1
CVSS changed
May 26, 2026 - 13:37 NVD
7.5 (HIGH) 7.7 (HIGH)

DescriptionCVE.org

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Executive ViewAI

Why It Matters

npm's pacote package (versions 11.2.7 and later) contains a denial-of-service vulnerability that allows remote attackers to exhaust server CPU resources through crafted package specifications, directly impacting the availability of any service that parses untrusted package data. No active exploitation has been reported, but the attack is trivially automatable and threatens deployment pipelines and registry services.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 89% exploitable
Threat Intel
1
1 source
Social Media
3
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-116693 HIGH POC
8.7
CVE-2026-48801 HIGH POC
8.7
CVE-2026-57584 HIGH POC
8.7
CVE-2026-118686 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:72116 ADVISORY https://access.redhat.com/errata/RHSA-2026:72497 ADVISORY https://access.redhat.com/errata/RHSA-2026:75864 ADVISORY https://access.redhat.com/errata/RHSA-2026:75870 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9496 ADVISORY https://vuldb.com/vuln/365606 REF https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2 REF https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508 REF https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025 REF https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy