pacote EUVD-2026-31793

Patch available per vendor advisory - upgrade pacote to the fixed release identified in the Snyk advisories at https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084 and https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025 (exact fixed version is not independently confirmed in the data provided, so consult the advisory for the current safe version). Audit transitive dependencies with npm ls pacote and yarn why pacote, since most exposure is indirect through npm, npm-registry-fetch, or build tooling. If patching is blocked, compensating controls should focus on the input boundary: validate and length-cap any user-supplied package spec strings before they reach pacote (reject specs longer than a few hundred characters and those containing repeated

or @ delimiters), enforce per-request CPU/time budgets on package-resolution workers so a single bad spec cannot stall the event loop indefinitely, and isolate resolution in worker threads or subprocess sandboxes with timeouts. Avoid the broad workaround of disabling Git spec support unless your workflow truly does not need it, as that breaks legitimate git+https:// and github: dependencies.