Executive brief
npm pacote is a package fetcher used in the Node.js ecosystem to download and manage npm dependencies. A flaw in the addGitSha function allows an attacker to send a crafted input that causes the tool to consume excessive CPU resources, effectively freezing or crashing systems that rely on it. This could disrupt CI/CD pipelines, package installations, and automated dependency management across organizations.
Technical details
The vulnerability is a resource-exhaustion flaw (CWE-400 and CWE-1333) in the addGitSha function of pacote. When processing a specially crafted spec.rawSpec parameter, the function's regex replacement and string-manipulation logic enters a pathological state, consuming excessive CPU cycles and potentially causing denial of service. The attack vector is network-based with no authentication or user interaction required. An attacker can trigger this by directly calling pacote with a malicious spec or by hosting a malicious package in a registry. Pacote versions 11.2.7 through 21.5.0 are affected; the fix is available in version 21.5.1 and later.
Affected products
- npm pacote >= 11.2.7, < 21.5.1
Timeline
- 2026-05-26: disclosed: Published to GitHub Advisory Database
- 2026-05-26: patched: Patched in version 21.5.1
References
- https://api.github.com/users/Capco-srachels
- https://github.com/Capco-srachels
- https://api.github.com/users/Capco-srachels/gists%7B/gist_id%7D
- https://api.github.com/users/Capco-srachels/repos
- https://avatars.githubusercontent.com/u/170579460?v=4
- https://api.github.com/users/Capco-srachels/events%7B/privacy%7D