CVE-2026-9496
EUVD-2026-3179326.05.2026, 07:16
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.Enginsight
Awaiting analysis
This vulnerability is currently awaiting analysis.
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| nodejs20 |
| ||||||||
| nodejs20-devel |
| ||||||||
| nodejs20-docs |
| ||||||||
| nodejs22 |
| ||||||||
| nodejs22-devel |
| ||||||||
| nodejs22-docs |
| ||||||||
| nodejs24 |
| ||||||||
| nodejs24-devel |
| ||||||||
| nodejs24-docs |
| ||||||||
| npm20 |
| ||||||||
| npm22 |
| ||||||||
| npm24 |
|
Amazon Linux Releases
Amazon Package | |||
|---|---|---|---|
| nodejs22 |
| ||
| nodejs22-debuginfo |
| ||
| nodejs22-debugsource |
| ||
| nodejs22-devel |
| ||
| nodejs22-docs |
| ||
| nodejs22-full-i18n |
| ||
| nodejs22-libs |
| ||
| nodejs22-libs-debuginfo |
| ||
| nodejs22-npm |
| ||
| nodejs24 |
| ||
| nodejs24-debuginfo |
| ||
| nodejs24-debugsource |
| ||
| nodejs24-devel |
| ||
| nodejs24-docs |
| ||
| nodejs24-full-i18n |
| ||
| nodejs24-libs |
| ||
| nodejs24-libs-debuginfo |
| ||
| nodejs24-npm |
| ||
| v8-12.4-devel |
| ||
| v8-13.6-devel |
|
Common Weakness Enumeration
- CWE-1333 - Inefficient Regular Expression ComplexityThe product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
References