CVE-2026-9496

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing...

CVE-2026-9496

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...

CVE-2026-9496

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...

CVE-2026-9496

Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...

CVE-2026-9496

CVE-2026-9496 affects the npm package pacote

MAL-2022-5595 Malicious code in rawspec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fada61fd8c4c73d38d5dd22d733db59cc2e5cc176d61d189548787c195aa3604 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rawspec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fada61fd8c4c73d38d5dd22d733db59cc2e5cc176d61d189548787c195aa3604 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...