CVE-2026-9496: High severity npm/pacote vulnerability
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9496?
The severity of CVE-2026-9496 is high, with a score of 7.5.
How do I fix CVE-2026-9496?
To fix CVE-2026-9496, update the pacote package to a version that addresses the Denial of Service vulnerability.
What type of vulnerability is CVE-2026-9496?
CVE-2026-9496 is a Denial of Service (DoS) vulnerability affecting the pacote package.
Which versions of pacote are affected by CVE-2026-9496?
Versions of the pacote package from 11.2.7 are vulnerable to CVE-2026-9496.
How does an attacker exploit CVE-2026-9496?
An attacker can exploit CVE-2026-9496 by supplying a specially crafted spec.rawSpec value that triggers excessive regex replacement and string manipulation.