CVE-2026-9496: pacote Package DoS Vulnerability

CVE-2026-9496 Overview

CVE-2026-9496 is a Denial of Service (DoS) vulnerability affecting the pacote npm package starting from version 11.2.7. The flaw resides in the addGitSha function, which performs regex replacement and string-manipulation logic on the spec.rawSpec value. An attacker who supplies a specially crafted rawSpec input can trigger excessive CPU consumption, stalling or crashing the Node.js process. The issue is classified as an inefficient regular expression complexity weakness [CWE-1333] and uncontrolled resource consumption [CWE-400]. Because pacote is the package fetcher used internally by npm and many JavaScript build toolchains, the vulnerability has broad reach across CI/CD pipelines and package registries.

Critical Impact
A remote attacker can cause sustained CPU exhaustion in any process that resolves a malicious git-based package specifier through pacote, disrupting build systems, registry mirrors, and dependency resolution services.

Affected Products

pacote npm package, versions from 11.2.7 onward
JavaScript ecosystem tooling that bundles vulnerable pacote releases (tracked as SNYK-JS-PACOTE-8225084)
WebJars npm distribution of pacote (tracked as SNYK-JAVA-ORGWEBJARSNPM-16874025)

Discovery Timeline

2026-05-26 - CVE-2026-9496 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-9496

Vulnerability Analysis

The pacote library resolves and fetches npm package tarballs, including packages referenced by git specifiers. When a git-based spec is processed, addGitSha in lib/util/add-git-sha.js normalizes the commit SHA into the spec string. The function applies regex-based replacement and concatenation against the user-supplied spec.rawSpec value. The regex pattern and string operations exhibit super-linear runtime behavior on adversarially crafted input, producing a Regular Expression Denial of Service (ReDoS) condition. Processing a single malicious spec consumes one CPU core for an extended period, which is sufficient to stall package installation, dependency resolution, or any automation that invokes pacote programmatically.

Root Cause

The root cause is inefficient regular expression complexity [CWE-1333] combined with uncontrolled resource consumption [CWE-400] in the addGitSha helper. The function does not bound the length or validate the structure of spec.rawSpec before applying its replacement logic, allowing catastrophic backtracking on pathological inputs.

Attack Vector

The vulnerability is reachable over the network wherever an untrusted actor controls a package specifier passed to pacote. Typical exposure includes registry proxies, package metadata indexers, hosted build services that accept arbitrary package.json files, and any web service that resolves git dependencies on behalf of users. No authentication or user interaction is required to trigger the condition.

No public proof-of-concept is available. Reproduction requires invoking pacote resolution against a crafted git spec whose rawSpec value triggers catastrophic backtracking in the addGitSha regex. See the GitHub source for add-git-sha.js and the Snyk JavaScript advisory for technical details.

Detection Methods for CVE-2026-9496

Indicators of Compromise

Sustained 100% CPU utilization in a single Node.js worker thread tied to an npm install, npm pack, or pacote resolver process.
Build jobs or registry workers that hang during git dependency resolution without producing log output.
Anomalously long rawSpec values or specs containing repeating non-hex character sequences submitted to package resolution endpoints.

Detection Strategies

Inventory all Node.js services and CI runners and flag any pacote version at or above 11.2.7 that has not been updated to a fixed release.
Instrument package resolution code paths with per-request CPU and wall-clock timeouts to surface long-running addGitSha invocations.
Inspect package manifests and registry traffic for git specifiers containing unusually long or malformed rawSpec values.

Monitoring Recommendations

Alert on Node.js processes exceeding configured CPU-time thresholds during dependency installation.
Capture and centralize CI/CD build duration metrics; investigate outliers that correlate with git-based dependency installs.
Monitor registry proxy and mirror logs for repeated requests that trigger resolver timeouts from the same source.

How to Mitigate CVE-2026-9496

Immediate Actions Required

Identify every direct and transitive dependency on pacote in production, build, and developer environments using npm ls pacote.
Upgrade pacote to a version that addresses the addGitSha ReDoS, per the Snyk JavaScript advisory and the WebJars advisory.
Restrict untrusted users from submitting arbitrary git package specifiers to hosted build or resolution services until patched.

Patch Information

Refer to the upstream pacote repository and the linked Snyk advisories for the fixed version range. Update lockfiles (package-lock.json, npm-shrinkwrap.json, yarn.lock) after upgrading to ensure transitive instances of pacote are also bumped.

Workarounds

Reject or sanitize incoming package specifiers whose rawSpec length exceeds a conservative limit before passing them to pacote.
Run pacote-based resolution in isolated worker processes with hard CPU-time limits to contain ReDoS impact.
Disable git-based dependency resolution where it is not required by the build workflow.

bash

# Identify vulnerable pacote installations and force-upgrade
npm ls pacote
npm update pacote
npm audit fix --force

# Enforce a CPU-time limit on Node.js workers handling untrusted specs (Linux)
ulimit -t 10
node resolver.js