Vulnerability · Published May 26, 2026 · Assigned by snyk
CVE-2026-9496
High 7.5
In plain English
A high-severity regular-expression denial of service in org.webjars.npm:pacote. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | nodejs | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:10 | nodejs-devel | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs-devel | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-devel | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:10 | nodejs-docs | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs-docs | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-docs | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:10 | nodejs-full-i18n | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs-full-i18n | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-full-i18n | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:10 | nodejs-libs | 1:22.23.2-3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs-libs | 1:22.23.2-2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-libs | 1:22.23.2-2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:8 | nodejs-nodemon | 3.1.14-2.module_el8.10.0+4252+aedd4c30 | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-nodemon | 3.1.14-2.module_el9.8.0+302+959ebcd4 | ALSA-2026:76750 |
| AlmaLinux:10 | nodejs-npm | 1:10.9.8-1.22.23.2.3.el10_2 | ALSA-2026:75864 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:76750 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-6.module_el8.10.0+4158+e796f37f | ALSA-2026:75870 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-6.module_el9.7.0+227+12323393 | ALSA-2026:76750 |
| AlmaLinux:8 | npm | 1:10.9.8-1.22.23.2.2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | npm | 1:10.9.8-1.22.23.2.2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| AlmaLinux:8 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module_el8.10.0+4296+737cb4d7 | ALSA-2026:75870 |
| AlmaLinux:9 | v8-12.4-devel | 3:12.4.254.21-1.22.23.2.2.module_el9.8.0+322+f4aa738c | ALSA-2026:76750 |
| Debian:12 | npm | no fix listed | DEBIAN-CVE-2026-9496 |
| Debian:13 | npm | no fix listed | DEBIAN-CVE-2026-9496 |
| Debian:14 | npm | 12.0.2+ds1-1 | DEBIAN-CVE-2026-9496 |
| Rocky Linux:9 | nodejs | 1:22.23.2-2.module+el9.8.0+40374+17512296 | RLSA-2026:76750 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40278+50b003a3 | RLSA-2026:75870 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.1.14-2.module+el8.10.0+40277+b1b3f89e | RLSA-2026:75870 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40280+057606e8 | RLSA-2026:76750 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.1.14-2.module+el9.8.0+40264+d9b257bb | RLSA-2026:76750 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40048+6d99f608 | RLSA-2026:75870 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40172+38f6fdd1 | RLSA-2026:75870 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-6.module+el8.10.0+40171+8fa9c325 | RLSA-2026:75870 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.8.0+40164+8921ab53 | RLSA-2026:76750 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40052+e32ea525 | RLSA-2026:76750 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40153+4d595597 | RLSA-2026:76750 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-6.module+el9.7.0+40165+d075e3f2 | RLSA-2026:76750 |
| Rocky Linux:10 | nodejs22 | 1:22.23.2-3.el10_2 | RLSA-2026:75864 |
| Ubuntu:22.04:LTS | npm | no fix listed | UBUNTU-CVE-2026-9496 |
| Ubuntu:24.04:LTS | npm | no fix listed | UBUNTU-CVE-2026-9496 |
| Ubuntu:25.10 | npm | no fix listed | UBUNTU-CVE-2026-9496 |
| Ubuntu:26.04:LTS | npm | no fix listed | UBUNTU-CVE-2026-9496 |
| Ubuntu:26.10 | npm | no fix listed | UBUNTU-CVE-2026-9496 |
| npm | pacote | 21.5.1 | GHSA-w4pp-8pjf-rmxw |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | pacote | 11.2.7 – before 21.5.1 |
| n/a | org.webjars.npm:pacote | 11.2.7 – before * |
Weakness: CWE-1333, CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P
References
- https://security.snyk.io/vuln/SNYK-JS-PACOTE-8225084
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-16874025
- https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
- https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508