Vulnerability in pnpm Package Manager Affecting Multiple Versions

CVE-2026-50573

What is CVE-2026-50573?

The pnpm package manager, versions prior to 10.34.0 and 11.4.0, has a vulnerability where the pnpm install command in non-frozen mode can incorrectly accept new remote package content even if the integrity of the downloaded tarball does not match what is specified in the pnpm-lock.yaml file. This occurs when a package has an existing integrity value and later receives inconsistent metadata and tarball content from the registry. Although pnpm detects the initial integrity mismatch, it continues the installation process and updates the lockfile, which poses a risk as the integrity check is not enforced as a strict barrier to installation. Users should upgrade to the patched versions to mitigate this risk.

References