Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-25T16:50:21 pnpm: pnpm: Package integrity check bypass allows installation of malicious content 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N CWE-494

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0.

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to bypass package integrity checks during the `pnpm install` process when operating in non-frozen mode. If a malicious package registry serves altered content for a locked package, pnpm may accept this new content and update its lockfile. This could lead to the installation of unintended or malicious software, compromising the integrity and confidentiality of the system.

Moderate: This flaw in pnpm allows a compromised package registry to serve altered content for locked packages, bypassing integrity checks during `pnpm install` operations when not in frozen mode. This could lead to the installation of malicious or unintended software, impacting the integrity and confidentiality of development or build environments where `pnpm install` is used without the `--frozen-lockfile` option. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AMQ Broker 7 Fix deferred pnpm Red Hat Build of Keycloak Fix deferred pnpm Red Hat JBoss Enterprise Application Platform 8 Fix deferred pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Fix deferred pnpm https://www.cve.org/CVERecord?id=CVE-2026-50573 https://nvd.nist.gov/vuln/detail/CVE-2026-50573 https://github.com/pnpm/pnpm/security/advisories/GHSA-54hh-g5mx-jqcp