Regular expression denial of service in pacote
Priority HIGH 77CWE-1333Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 8 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1333.
Summary
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Partial pacote: 21.5.1pacote (npm): 21.5.1Red Hat: 11 advisoriesRed Hat: 10 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pacote | 11.2.7 to before 21.5.1 | 21.5.1 | Patch available | CNA |
| — | org.webjars.npm:pacote | 11.2.7 and later | — | No fix listed | CNA |
| — | pacote (npm) | 11.2.7 to before 21.5.1 | 21.5.1 | Patch available | GHSA-w4pp-8pjf-rmxw |
- pacote Vendor— Affected 11.2.7 to before 21.5.1 Fixed in 21.5.1 Patch available CNA
- org.webjars.npm:pacote Vendor— Affected 11.2.7 and later Fixed in — No fix listed CNA
- pacote (npm) Vendor— Affected 11.2.7 to before 21.5.1 Fixed in 21.5.1 Patch available GHSA-w4pp-8pjf-rmxw
Remediation
- Fix · CNA pacote Fixed in 21.5.1
- Fix · GHSA-w4pp-8pjf-rmxw pacote (npm) Fixed in 21.5.1 Advisory →
Red Hat 11 advisories
- RHSA-2026:92584 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:92578 Released 2026-10-29 · Red Hat rating ImportantGeneral availability of the satellite/iop-remediations-rhel9 container image
- Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-remediations-rhel9
- RHSA-2026:90321 Released 2026-10-26 · Red Hat rating CriticalRed Hat OpenShift Dev Spaces 3.31.0 Release.
- Red Hat OpenShift Dev Spaces 3.31 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/jetbrains-ide-rhel9 +8
Show 8 more Red Hat advisories
- RHSA-2026:88200 Released 2026-10-22 · Red Hat rating CriticalAnsible automation portal Red Hat Enterprise Linux Images
- Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9
- RHSA-2026:84703 Released 2026-10-19 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs-1:22.23.2-2.el10_0, nodejs-devel-1:22.23.2-2.el10_0, nodejs-docs-1:22.23.2-2.el10_0 +4
- RHSA-2026:84589 Released 2026-10-19 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs-1:22.23.2-2.module+el9.6.0+25055+19201b10.aarch64::nodejs:22, nodejs-1:22.23.2-2.module+el9.6.0+25055+19201b10.ppc64le::nodejs:22, nodejs-1:22.23.2-2.module+el9.6.0+25055+19201b10.s390x::nodejs:22 +28
- RHSA-2026:76750 Released 2026-10-08 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.aarch64::nodejs:22, nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.ppc64le::nodejs:22, nodejs-1:22.23.2-2.module+el9.8.0+24958+80b2ac6e.s390x::nodejs:22 +28
- RHSA-2026:75864 Released 2026-10-05 · Red Hat rating Importantnodejs22 security update
- Red Hat Enterprise Linux AppStream (v. 10) nodejs-1:22.23.2-3.el10_2, nodejs-devel-1:22.23.2-3.el10_2, nodejs-docs-1:22.23.2-3.el10_2 +4
- RHSA-2026:75870 Released 2026-10-05 · Red Hat rating Importantnodejs:22 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:22.23.2-2.module+el8.10.0+24957+74108fbf.aarch64::nodejs:22, nodejs-1:22.23.2-2.module+el8.10.0+24957+74108fbf.ppc64le::nodejs:22, nodejs-1:22.23.2-2.module+el8.10.0+24957+74108fbf.s390x::nodejs:22 +28
- RHSA-2026:72497 Released 2026-09-28 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.10-0.9.hum1@aarch64, grafana12.4-12.4.10-0.9.hum1@src, grafana12.4-12.4.10-0.9.hum1@x86_64
- RHSA-2026:72116 Released 2026-09-25 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images grafana12.4-12.4.10-0.8.hum1@aarch64, grafana12.4-12.4.10-0.8.hum1@src, grafana12.4-12.4.10-0.8.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 2.2 | Fixed | RHSA-2026:88200 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:75864 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:75870 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:76750 |
| Red Hat Enterprise Linux AppStream EUS (v. 10.0) | Fixed | RHSA-2026:84703 |
| Red Hat Enterprise Linux AppStream EUS (v.9.6) | Fixed | RHSA-2026:84589 |
| Red Hat Hardened Images | Fixed | RHSA-2026:72116, RHSA-2026:72497 |
| Red Hat OpenShift Dev Spaces 3.31 | Fixed | RHSA-2026:90321 |
| Red Hat Satellite 6.18 | Fixed | RHSA-2026:92584 |
| Red Hat Satellite 6.19 | Fixed | RHSA-2026:92578 |
Not affected: 9 products
- Migration Toolkit for Applications 8
- Red Hat 3scale API Management Platform 2
- Red Hat Connectivity Link 1
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat OpenShift Dev Spaces 3.31
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9496
- 2026-10-03 Alias added: GHSA-w4pp-8pjf-rmxw
- 2026-10-06 Fix available: RHSA-2026:75870 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:75864 · Red Hat
- 2026-10-06 Fix available: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
- 2026-10-08 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
- 2026-10-09 Fix available: RHSA-2026:76750 · Red Hat
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-18 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84703 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84589 · Red Hat
- 2026-10-20 Fix available: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88200 · Red Hat
- 2026-10-23 Fix available: Red Hat Ansible Automation Platform 2.2 · Red Hat
- 2026-10-29 Fix available: Red Hat OpenShift Dev Spaces 3.31 · Red Hat
- 2026-10-30 Fix available: RHSA-2026:90321 · Red Hat
- 2026-10-30 Fix available: Red Hat Satellite 6.18, Red Hat Satellite 6.19 · Red Hat
- 2026-10-31 Fix available: RHSA-2026:92578 · Red Hat
- 2026-11-03 Fix available: RHSA-2026:92584 · Red Hat
References
Other 6
- https://github.com/npm/pacote/blob/9d7459440826ab4cf962ef98d8f3fd0c4d464b5c/lib/util/add-git-sha.js%23L2C1-L13C2
- https://github.com/npm/pacote/commit/ce804fb1647fe1699b2f87efd01ea9f4efed8508
- https://github.com/npm/pacote/commit/627a7dc1a214d857472a13b48e42559c75288c9e
- https://github.com/npm/pacote
- https://github.com/npm/pacote/releases/tag/v21.5.1
- https://github.com/npm/pacote/releases/tag/v22.0.0
Sources
- CVE-2026-9496 · CVE Program
- CVE-2026-9496 · NVD
- FIRST EPSS
- GHSA-w4pp-8pjf-rmxw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-9496 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences