p PatchFirst

CVE-2026-9496

CVE-2026-9496

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

CVSS 8.7 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • pacote

    Versions
    • ≥ 11.2.7, < 21.5.1: Affected (semver)

    Update to 21.5.1

  • org.webjars.npm:pacote

    Versions
    • ≥ 11.2.7: Affected (semver)

    No fix published

  • npm Debian:12

    Versions
    • 11.12.1~ds1-1
    • 11.12.1~ds1-2
    • 11.12.1~ds1-3
    • 11.12.1~ds1-4
    • 11.13.0~ds1-1
    • 11.16.0+ds2-1
    • 11.16.0+ds2-2
    • 11.16.0+ds2-3
    • 11.16.0+ds2-4
    • 11.19.0+ds1-1
    • 11.19.0+ds1-2
    • 11.19.0-1
    • 12.0.2+ds1-1
    • 12.0.2+ds1-2
    • 9.2.0~ds1-1
    • 9.2.0~ds1-2
    • 9.2.0~ds1-3
    • 9.2.0~ds1-4
    • 9.2.0~ds2-1
    • 9.2.0~ds2-2
    • 9.2.0~ds3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Debian:13

    Versions
    • 11.12.1~ds1-1
    • 11.12.1~ds1-2
    • 11.12.1~ds1-3
    • 11.12.1~ds1-4
    • 11.13.0~ds1-1
    • 11.16.0+ds2-1
    • 11.16.0+ds2-2
    • 11.16.0+ds2-3
    • 11.16.0+ds2-4
    • 11.19.0+ds1-1
    • 11.19.0+ds1-2
    • 11.19.0-1
    • 12.0.2+ds1-1
    • 12.0.2+ds1-2
    • 9.2.0~ds1-3
    • 9.2.0~ds1-4
    • 9.2.0~ds2-1
    • 9.2.0~ds2-2
    • 9.2.0~ds3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Debian:14

    Versions
    • 11.12.1~ds1-1
    • 11.12.1~ds1-2
    • 11.12.1~ds1-3
    • 11.12.1~ds1-4
    • 11.13.0~ds1-1
    • 11.16.0+ds2-1
    • 11.16.0+ds2-2
    • 11.16.0+ds2-3
    • 11.16.0+ds2-4
    • 11.19.0+ds1-1
    • 11.19.0+ds1-2
    • 11.19.0-1
    • 9.2.0~ds1-3
    • 9.2.0~ds1-4
    • 9.2.0~ds2-1
    • 9.2.0~ds2-2
    • 9.2.0~ds3-1
    Affected ranges
    • ECOSYSTEM: < 12.0.2+ds1-1

    Update to 12.0.2+ds1-1

  • pacote npm

    Affected ranges
    • SEMVER: ≥ 11.2.7, < 21.5.1

    Update to 21.5.1

  • npm Ubuntu:14.04:LTS

    Versions
    • 1.2.18~dfsg-3
    • 1.3.10~dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:Pro:16.04:LTS

    Versions
    • 1.4.21+ds-2
    • 3.5.2-0ubuntu4
    • 3.5.2-0ubuntu4.1.16.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:Pro:18.04:LTS

    Versions
    • 3.5.2-0ubuntu4
    • 3.5.2-0ubuntu4.1.18.04.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:20.04:LTS

    Versions
    • 5.8.0+ds6-4
    • 6.14.4+ds-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:22.04:LTS

    Versions
    • 7.5.2+ds-2
    • 7.24.2+ds-1
    • 7.24.2+ds-2
    • 8.3.0~ds-1
    • 8.3.0~ds-2
    • 8.3.2~ds-1
    • 8.5.0~ds-1
    • 8.5.1~ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:24.04:LTS

    Versions
    • 9.2.0~ds1-1
    • 9.2.0~ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:25.10

    Versions
    • 9.2.0~ds1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:26.10

    Versions
    • 9.2.0~ds3-1
    • 11.16.0+ds2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • npm Ubuntu:26.04:LTS

    Versions
    • 9.2.0~ds1-3
    • 9.2.0~ds2-2
    • 9.2.0~ds3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →