# CVE-2026-50021: pnpm integrity check bypass in tarball extraction worker

Source: https://junglewise.ai/threats/cve-2026-50021-pnpm-integrity-check-bypass-in-tarball-extraction-worker  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-26  
License: CC BY 4.0 with a link back

CVE-2026-50021 · Severity: medium · CVSS 6.8 · Published 2026-06-25

A vulnerability in the pnpm package manager allows for the installation of tampered software packages without detection. pnpm is used by developers to manage project dependencies; if an attacker can modify a project's lockfile and control the package source, they can inject malicious code into the development environment. This bypasses the security checks intended to ensure that downloaded code matches what the developer originally approved.

Technologies: [pnpm (npm)](https://junglewise.ai/threats/technologies/pnpm). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-50021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50021 being exploited in the wild.

**How severe is CVE-2026-50021?** Medium severity, with a CVSS score of 6.8, published 25 June 2026.

**Which products and versions are affected?** pnpm (npm) SEMVER:introduced=11.0.0,fixed=11.4.0.

**Is there a fix for CVE-2026-50021?** Yes. pnpm (npm): upgrade to 11.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50021 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50021?** Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pnpm (npm): upgrade to 11.4.0 or later

  ```sh
  npm install pnpm@11.4.0
  ```


## Technical details

An integrity check bypass exists in pnpm's tarball extraction worker. The 'addTarballToStore' function in 'worker/src/start.ts' uses an optional 'integrity' field; if this field is absent from the 'pnpm-lock.yaml' file, the 'if (integrity)' guard evaluates to false and skips hash verification entirely. An attacker who can modify the lockfile to remove this field and simultaneously compromise the package registry (or perform a man-in-the-middle attack) can serve malicious tarballs that pnpm will accept as legitimate. This vulnerability is particularly impactful when using the '--frozen-lockfile' flag, as it fails open rather than rejecting the insecure configuration. Patches are available in versions 10.34.1 and 11.4.0.

## Affected products

- pnpm pnpm >= 11.0.0, < 11.4.0
- pnpm pnpm < 10.34.1

## Identifiers

- CVE-2026-50021
- GHSA-q6j5-fjx5-2mc3

## Timeline

- 2026-05-28: disclosed
- 2026-06-25: advisory: NVD publication
- 2026-06-26: patched: GitHub Advisory reviewed and updated

## References

- [https://api.github.com/users/tempcollab](https://api.github.com/users/tempcollab)
- [https://github.com/tempcollab](https://github.com/tempcollab)
- [https://api.github.com/users/tempcollab/gists%7B/gist_id%7D](https://api.github.com/users/tempcollab/gists%7B/gist_id%7D)
- [https://api.github.com/users/tempcollab/repos](https://api.github.com/users/tempcollab/repos)
- [https://avatars.githubusercontent.com/u/86631197?v=4](https://avatars.githubusercontent.com/u/86631197?v=4)
- [https://api.github.com/users/tempcollab/events%7B/privacy%7D](https://api.github.com/users/tempcollab/events%7B/privacy%7D)

## Related threats

- [pnpm environment secret exfiltration via proxy settings in workspace manifest](https://junglewise.ai/threats/pnpm-environment-secret-exfiltration-via-proxy-settings-in-workspace-f6626cca)
- [pnpm pacquet path traversal in lockfile dependency symlinks](https://junglewise.ai/threats/pnpm-pacquet-path-traversal-in-lockfile-dependency-symlinks-dc3f81d1)
- [pnpm tarball dependency manifest name path traversal arbitrary file write](https://junglewise.ai/threats/cve-2026-82393-pnpm-tarball-dependency-manifest-name-path-traversal-arbitrary)
- [pnpm virtual store linker path traversal via unvalidated depPath](https://junglewise.ai/threats/cve-2026-82392-pnpm-virtual-store-linker-path-traversal-via-unvalidated-deppath)
- [pnpm path traversal via crafted lockfile alias](https://junglewise.ai/threats/cve-2026-59196-pnpm-path-traversal-via-crafted-lockfile-alias)