Is CVE-2026-50021 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50021 being exploited in the wild.

How severe is CVE-2026-50021?

Medium severity, with a CVSS score of 6.8, published 25 June 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=11.0.0,fixed=11.4.0.

Is there a fix for CVE-2026-50021?

Yes. pnpm (npm): upgrade to 11.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50021 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50021?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50021: pnpm integrity check bypass in tarball extraction worker

CVE-2026-50021 · Severity: medium · CVSS 6.8 · Published 2026-06-25

A vulnerability in the pnpm package manager allows for the installation of tampered software packages without detection. pnpm is used by developers to manage project dependencies; if an attacker can modify a project's lockfile and control the package source, they can inject malicious code into the development environment. This bypasses the security checks intended to ensure that downloaded code matches what the developer originally approved.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-50021 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50021 being exploited in the wild.
How severe is CVE-2026-50021?: Medium severity, with a CVSS score of 6.8, published 25 June 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=11.0.0,fixed=11.4.0.
Is there a fix for CVE-2026-50021?: Yes. pnpm (npm): upgrade to 11.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50021 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50021?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 11.4.0 or later
```
npm install pnpm@11.4.0
```

Technical details

An integrity check bypass exists in pnpm's tarball extraction worker. The 'addTarballToStore' function in 'worker/src/start.ts' uses an optional 'integrity' field; if this field is absent from the 'pnpm-lock.yaml' file, the 'if (integrity)' guard evaluates to false and skips hash verification entirely. An attacker who can modify the lockfile to remove this field and simultaneously compromise the package registry (or perform a man-in-the-middle attack) can serve malicious tarballs that pnpm will accept as legitimate. This vulnerability is particularly impactful when using the '--frozen-lockfile' flag, as it fails open rather than rejecting the insecure configuration. Patches are available in versions 10.34.1 and 11.4.0.

Affected products

pnpm pnpm >= 11.0.0, < 11.4.0
pnpm pnpm < 10.34.1

Identifiers

CVE-2026-50021
GHSA-q6j5-fjx5-2mc3

Timeline

2026-05-28: disclosed
2026-06-25: advisory: NVD publication
2026-06-26: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.