---
id: CVE-2026-50021
title: pnpm is a package manager
summary: >-
  pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball
  extraction worker skips integrity verification when the integrity field is
  absent from the lockfile resolution. If an attacker can both modify
  pnpm-lock.yaml to remov…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-354
vendor: pnpm
product: pnpm
affected:
  - pnpm < 10.34.0
  - 'pnpm >= 11.0.0, < 11.4.0'
patched:
  - pnpm 11.4.0
published: '2026-06-25'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:17:46.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50021'
references:
  - url: 'https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3'
    label: security-advisories@github.com
  - url: 'https://github.com/pnpm/pnpm/security/advisories/GHSA-q6j5-fjx5-2mc3'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-50021'
  - url: 'https://github.com/advisories/GHSA-q6j5-fjx5-2mc3'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-26T03:56:15.445797Z'
epss: 0.00181
epssPercentile: 0.07739
ecosystem: npm
ingestedAt: '2026-06-29T13:24:35.088Z'
---

## Overview

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's tarball extraction worker skips integrity verification when the integrity field is absent from the lockfile resolution. If an attacker can both modify pnpm-lock.yaml to remove the integrity: field and cause the referenced registry URL to serve altered package content, pnpm install --frozen-lockfile can install the altered package without an integrity error. npm's npm ci enforces integrity by default; pnpm's behavior of silently skipping verification is a pnpm-specific fail-open gap. This vulnerability is fixed in 10.34.0 and 11.4.0.

## Affected

- `pnpm < 10.34.0`
- `pnpm >= 11.0.0, < 11.4.0`

## Remediation

Upgrade past the affected range:

- `pnpm 11.4.0`

## Package advisory (CVE-2026-50021)

Affected packages:

- `pnpm >= 11.0.0, < 11.4.0`
- `pnpm < 10.34.1`

Patched in:

- `pnpm 11.4.0`
- `pnpm 10.34.1`

Source: https://github.com/advisories/GHSA-q6j5-fjx5-2mc3