Peer-suffix Normalizer Vulnerability in pnpm Package Manager
CVE-2026-55487

7.5HIGH

Key Information:

Vendor

Pnpm

Status
Pnpm
Vendor
CVE Published:
25 June 2026

What is CVE-2026-55487?

pnpm, a widely-used package manager, has a vulnerability due to its peer-suffix normalizer improperly handling certain input formats. Specifically, prior to versions 10.34.2 and 11.5.3, the normalizer stripped parenthesized text from various opaquely sourced locators such as git, URL, and file paths. This flaw allows a malicious actor to potentially authorize a different source string that normalizes to the same value as an approved entry, leading to possible unauthorized access or manipulation of resources. Users of pnpm should upgrade to the patched versions immediately to mitigate these risks.

Affected Version(s)

pnpm < 10.34.2 < 10.34.2

pnpm >= 11.0.0, < 11.5.3 < 11.0.0, 11.5.3

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-5wx...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.