CVE-2026-9496

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-26 · updated 2026-07-23
Weakness: CWE-1333

Description

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Affected products

org.webjars.npm:pacote: from 11.2.7
pacote: from 11.2.7 before 21.5.1 — fixed in 21.5.1

How to fix

Upgrade to a fixed version: pacote 21.5.1. Check the vendor advisory for mitigations.

References

https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084
https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084

Get alerted when CVE-2026-9496 or the next vulnerability affects your stack