CVE-2026-9496

EUVD-2026-31793
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic,  causing excessive CPU consumption and potentially stalling or crashing the process.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
nodejs22
suse enterprise sap 15 SP7
22.23.0-150700.3.12.1
fixed
suse enterprise server 15 SP6
22.23.0-150600.13.18.1
fixed
suse enterprise server 15 SP7
22.23.0-150700.3.12.1
fixed
nodejs22-devel
suse enterprise sap 15 SP7
22.23.0-150700.3.12.1
fixed
suse enterprise server 15 SP6
22.23.0-150600.13.18.1
fixed
suse enterprise server 15 SP7
22.23.0-150700.3.12.1
fixed
nodejs22-docs
suse enterprise sap 15 SP7
22.23.0-150700.3.12.1
fixed
suse enterprise server 15 SP6
22.23.0-150600.13.18.1
fixed
suse enterprise server 15 SP7
22.23.0-150700.3.12.1
fixed
nodejs24
suse enterprise sap 15 SP7
24.17.0-150700.15.11.1
fixed
suse enterprise server 15 SP7
24.17.0-150700.15.11.1
fixed
nodejs24-devel
suse enterprise sap 15 SP7
24.17.0-150700.15.11.1
fixed
suse enterprise server 15 SP7
24.17.0-150700.15.11.1
fixed
nodejs24-docs
suse enterprise sap 15 SP7
24.17.0-150700.15.11.1
fixed
suse enterprise server 15 SP7
24.17.0-150700.15.11.1
fixed
npm22
suse enterprise sap 15 SP7
22.23.0-150700.3.12.1
fixed
suse enterprise server 15 SP6
22.23.0-150600.13.18.1
fixed
suse enterprise server 15 SP7
22.23.0-150700.3.12.1
fixed
npm24
suse enterprise sap 15 SP7
24.17.0-150700.15.11.1
fixed
suse enterprise server 15 SP7
24.17.0-150700.15.11.1
fixed
Common Weakness Enumeration
References
https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084
https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084