NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

pacote is vulnerable to Denial of Service (DoS) via the addGitSha functionGHSA-w4pp-8pjf-rmxw

HIGHFix: npm/pacote@627a7dc

GHSA-w4pp-8pjf-rmxw is a high-severity (CVSS 7.5) CWE-1333 vulnerability in pacote. A fix is available for pacote — see the affected versions and patch details below.

Also known asCVE-2026-9496
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA’s SSVC triage for GHSA-w4pp-8pjf-rmxw.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs28th percentile — riskier than 28% of all scored CVEsHighest risk
0.00%0.38%0.75%1.13%0.0%0.3%Jun 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

695other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
pacotenpm
16.8Mdownloads / week

Description

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
📦npmpacote≥ 11.2.7&&< 21.5.121.5.1npm install pacote@21.5.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for pacote, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update pacote to 21.5.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-w4pp-8pjf-rmxw is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

A flaw was found in the pacote npm package. Pacote retrieves package metadata and archives from npm registries, Git repositories, and other sources. In affected versions, the addGitSha function strips Git committish information from a package specification using a regular expression that is vulnerable to inefficient…

Workaround published by Red Hat
To mitigate this limit the length of incoming package specifiers (spec.rawSpec) before they reach the resolution service. Enforce hard CPU time limits or timeouts on isolated build jobs and package resolution processes.
Source: Red Hat security advisory for GHSA-w4pp-8pjf-rmxw (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Enterprise Linux 10nodejs22-1:22.23.2-3.el10_2RHSA-2026:75864
Red Hat Enterprise Linux 10.0 Extended Update Supportnodejs22-1:22.23.2-2.el10_0RHSA-2026:84703
Red Hat Enterprise Linux 8nodejs:22-8100020260928121333.6d880403RHSA-2026:75870
Red Hat Enterprise Linux 9nodejs:22-9080020260928121441.rhel9RHSA-2026:76750
Red Hat Enterprise Linux 9.6 Extended Update Supportnodejs:22-9060020261009101511.rhel9RHSA-2026:84589
Red Hat Ansible Automation Platform 2.2ansible-automation-platform/bootc-automation-portal-rhel9:1792641102RHSA-2026:88200
Red Hat Hardened Imagesgrafana12-4-main-12.4.10-0.8.hum1RHSA-2026:72116
Red Hat Hardened Imagesgrafana12-4-main-12.4.10-0.9.hum1RHSA-2026:72497

Frequently Asked Questions

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
O3 Security · Impact-Aware SCA

Is GHSA-w4pp-8pjf-rmxw in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
pacote is vulnerable to Denial of Service (DoS) via the…