PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50573 pnpm CVE debrief

CVE-2026-50573 is a vulnerability in pnpm, a package manager used for Node.js projects. The issue arises during the installation of packages in non-frozen mode. Prior to versions 10.34.0 and 11.4.0, pnpm's install process can accept new remote package content even after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. This occurs when a package is already locked with an integrity value, but the registry later serves different metadata and tarball content for the same package name and version. Initially, pnpm reports an integrity mismatch. However, in a plain pnpm install, a resolution repair is performed, accepting the registry's new integrity, updating the lockfile, installing the new content, and exiting successfully. This means the lockfile integrity check does not act as a hard stop by default. The vulnerability is fixed in pnpm versions 10.34.0 and 11.4.0.

Vendor
pnpm
Product
Unknown
CVSS
MEDIUM 6.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-06-29
Advisory published
2026-06-25
Advisory updated
2026-06-29

Who should care

Developers and security teams using pnpm for package management in Node.js projects should be aware of this vulnerability. Given its medium severity and potential impact on package integrity, users should prioritize updating to a fixed version of pnpm. This is particularly important for environments where package integrity and security are critical.

Technical summary

The vulnerability in pnpm allows for the bypass of package integrity checks during installation in non-frozen mode. This can lead to the installation of packages with compromised or altered content, potentially resulting in security issues within the project. The vulnerability is due to the way pnpm handles package installation and lockfile updates. Specifically, when a package's integrity is already recorded in the lockfile, but the package registry provides different content, pnpm may accept this new content without properly enforcing the integrity check. This behavior can be exploited by malicious actors to compromise package integrity.

Defensive priority

High priority should be given to updating pnpm to versions 10.34.0 or 11.4.0, or later, to ensure that package integrity checks are enforced properly. Additionally, users should review their current pnpm configurations and consider enabling frozen mode for package installations to enhance security.

Recommended defensive actions

  • Update pnpm to version 10.34.0 or 11.4.0, or later.
  • Review and adjust pnpm configurations to ensure package integrity checks are enforced.
  • Consider enabling frozen mode for package installations.
  • Monitor package registry for any suspicious activity related to installed packages.
  • Perform regular security audits of project dependencies.

Evidence notes

The CVE-2026-50573 vulnerability is documented in the official CVE record and the National Vulnerability Database (NVD). The issue is also addressed in a security advisory by pnpm on GitHub. These sources provide detailed information about the vulnerability, its impact, and the fixes available.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-50573 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-50573

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-50573 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-50573

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.