npm/pacote

npm/pacote

GitHubGitHub
GitHubgithub.com
Releases237
Frequency2 weeks 11 hours
Last Release
Stars393
npm fetcher
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2026-9496↗
7.5 HIGH—

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.