Skip to main content

pacote EUVDEUVD-2026-31793

| CVE-2026-9496 HIGH
Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)
2026-05-26 snyk GHSA-w4pp-8pjf-rmxw
Denial Of Service N A Pacote Org Webjars Npm
7.7
CVSS 4.0 · Vendor: snyk
Share

Severity by source

Vendor (snyk) PRIMARY
7.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (snyk).

CVSS VectorVendor: snyk

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jun 08, 2026 - 10:27 vuln.today
CVSS changed
May 26, 2026 - 13:37 NVD
7.5 (HIGH) 7.7 (HIGH)

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 16 npm packages depend on pacote (5 direct, 11 indirect)

Ecosystem-wide dependent count for version 11.2.7.

DescriptionCVE.org

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

AnalysisAI

Denial of service in npm's pacote package (versions 11.2.7 and later) allows remote unauthenticated attackers to exhaust CPU by submitting a crafted spec.rawSpec value to the addGitSha function, where vulnerable regex and string-manipulation logic exhibits catastrophic backtracking. CVSS 4.0 scores this 7.7 (high availability impact, no integrity/confidentiality impact) and SSVC labels exploitation as POC with automatable=yes, though EPSS remains low at 0.04% (11th percentile). No active exploitation has been reported and no public exploit identified at time of analysis, but the bug is trivially triggerable wherever pacote parses untrusted package specs.

Technical ContextAI

pacote is the package-fetching library that underpins the npm CLI and many JavaScript tooling ecosystems - it resolves, extracts, and verifies npm packages including Git-based specifications. The vulnerable code lives in lib/util/add-git-sha.js, where addGitSha applies regex replacement and string concatenation against the raw spec string supplied by a caller. The CWE-1333 classification identifies this as Inefficient Regular Expression Complexity (ReDoS), meaning a pathological input drives the regex engine into exponential or polynomial backtracking. Because pacote is consumed transitively by npm itself, yarn, and any tool that accepts user-controllable package specs (registries, CI runners, dependency-analysis services), the surface area extends well beyond direct users of the library. The org.webjars.npm:pacote CPE indicates the same vulnerable code is also republished through the WebJars Maven distribution channel.

RemediationAI

Patch available per vendor advisory - upgrade pacote to the fixed release identified in the Snyk advisories at https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084 and https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025 (exact fixed version is not independently confirmed in the data provided, so consult the advisory for the current safe version). Audit transitive dependencies with npm ls pacote and yarn why pacote, since most exposure is indirect through npm, npm-registry-fetch, or build tooling. If patching is blocked, compensating controls should focus on the input boundary: validate and length-cap any user-supplied package spec strings before they reach pacote (reject specs longer than a few hundred characters and those containing repeated

or @ delimiters), enforce per-request CPU/time budgets on package-resolution workers so a single bad spec cannot stall the event loop indefinitely, and isolate resolution in worker threads or subprocess sandboxes with timeouts. Avoid the broad workaround of disabling Git spec support unless your workflow truly does not need it, as that breaks legitimate git+https:// and github: dependencies.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-1333 – Inefficient Regular Expression Complexity (ReDoS)

View all
CVE-2023-29486 CRITICAL POC
9.8
CVE-2023-29487 CRITICAL POC
9.1
CVE-2026-48801 HIGH POC
8.7
CVE-2024-58340 HIGH POC
8.7
CVE-2026-0621 HIGH POC
8.7
CVE-2024-21490 HIGH POC
7.5
CVE-2022-42969 HIGH POC
7.5
CVE-2015-8315 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

EUVD-2026-31793 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy