Is CVE-2026-55487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55487 being exploited in the wild.

How severe is CVE-2026-55487?

High severity, with a CVSS score of 7.5, published 25 June 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=0,fixed=10.34.2.

Is there a fix for CVE-2026-55487?

Yes. pnpm (npm): upgrade to 10.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55487 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-55487?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55487: pnpm build policy bypass via opaque locator normalization spoofing

CVE-2026-55487 · Severity: high · CVSS 7.5 · Published 2026-06-25

pnpm is a popular JavaScript package manager that supports build approval policies for third-party dependencies. This vulnerability allows attackers to bypass build approval controls by spoofing package identities—an attacker can get approval for one package source and then run builds from a different attacker-controlled source. An exploit requires user interaction (manually approving a build) but could lead to arbitrary code execution during package installation.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-55487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55487 being exploited in the wild.
How severe is CVE-2026-55487?: High severity, with a CVSS score of 7.5, published 25 June 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=0,fixed=10.34.2.
Is there a fix for CVE-2026-55487?: Yes. pnpm (npm): upgrade to 10.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55487 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-55487?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.34.2 or later
```
npm install pnpm@10.34.2
```

Technical details

The vulnerability exists in pnpm's build approval policy implementation. The affected code applies generic peer-suffix normalization (stripping parenthesized text) to both registry and opaque (git, URL, tarball, file, directory) dependency locators. This normalization allows different source strings to collide: for example, both `foo@https://host/pkg.tgz` and `foo@https://host/pkg.tgz(evil)` normalize to the same value after parenthesized text is removed, allowing an attacker to construct a malicious locator that matches an approved source. The vulnerability class is CWE-346 (Origin Validation Error) and requires user interaction to approve a build. The patch (versions 10.34.2 and 11.5.3+) enforces byte-exact matching for opaque identities while retaining normalized matching for legitimate registry packages, preventing collision-based spoofing.

Affected products

pnpm pnpm <10.34.2, >=11.0.0 <11.5.3

Identifiers

CVE-2026-55487
GHSA-5wx6-mg75-v57r

Timeline

2026-06-26: disclosed: GHSA-5wx6-mg75-v57r published on OSV
2026-06-10: patched: Patch commit bf1b731ee6 merged to fix the original name-only approval bypass
2026-06-26: other: Final patch released in pnpm v10.34.2 and v11.5.3 addressing all three collision forms

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.