CVE-2026-50021: pnpm Integrity Verification Bypass in Package Installation

Technical summary

The vulnerability exists in pnpm's tarball extraction worker, which does not require integrity verification when the integrity field is omitted from a lockfile entry's resolution metadata. An attacker must be able to: (1) modify the pnpm-lock.yaml file to remove the integrity field from one or more package entries, and (2) intercept or control the registry URL to serve malicious package content. When pnpm extracts the tarball, the absence of an integrity value bypasses checksum validation entirely. This differs fundamentally from npm ci, which validates every package against its lockfile-declared hash regardless of whether the field is present. The flaw affects pnpm versions prior to 10.34.0 and 11.4.0, where the extraction logic was hardened to enforce integrity verification.

Business impact

Supply chain compromise risk is the primary concern. If a development team's repository is compromised or a contributor is coerced, an attacker can remove integrity checksums from the lockfile and cause the next install to pull malicious packages. This allows arbitrary code execution during the build or development phase, potentially affecting all downstream applications. The risk is heightened in CI/CD environments where pnpm install --frozen-lockfile is the standard practice. Organizations relying on pnpm across multiple projects face significant exposure if unpatched versions are in use; the attacker's prerequisites (lockfile modification + registry control) may be achievable through a combination of weak access controls and network compromise.

Affected systems

pnpm versions prior to 10.34.0 (in the 10.x branch) and prior to 11.4.0 (in the 11.x branch) are affected. Any project using these versions will skip integrity verification when an integrity field is absent from the lockfile. The impact is broadest in organizations with many pnpm-based projects, particularly those lacking strict code review on lockfile changes or running builds in environments accessible to network-level attackers.

Exploitability

The CVSS 3.1 score of 6.8 (MEDIUM, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that exploitation requires network access, high complexity (the attacker must both modify the lockfile and control a registry URL), and low privilege (the attacker must be someone with push access to the repository or the ability to modify the lock file). While not trivial, this is a realistic threat in scenarios involving repository compromise, insider access, or a combination of social engineering and network interception. The vulnerability is not currently tracked in the CISA KEV catalog, indicating it has not been observed in active exploitation campaigns as of the publication date.

Remediation

Upgrade pnpm to version 10.34.0 or later if using the 10.x branch, or to version 11.4.0 or later if using the 11.x branch. Verify the upgrade by checking the pnpm version in your CI/CD pipeline and development environments. Additionally, implement strong access controls on repository write permissions, enforce code review for lockfile changes, and consider pinning or scanning lockfile modifications as part of your supply chain security posture.

Patch guidance

Update pnpm by running npm install -g pnpm@latest or the equivalent package manager command for your environment. For monorepo or project-level pnpm installations specified in package.json, update the pnpm field in engines or use pnpm-manager directives to enforce the patched version. Verify the fix by running pnpm --version and confirming it reports 10.34.0, 11.4.0, or later. Test your existing lockfiles after upgrade to ensure no unintended changes; while the patch hardens verification logic, it should not alter installs when integrity fields are already present. If you have lockfiles with missing integrity fields, pnpm will now correctly enforce verification and may reject packages if the registry serves unexpected content.

Detection guidance

Monitor for pnpm invocations with --frozen-lockfile and check whether your audit logs or CI/CD system records which pnpm version was used. If you observe unexpected failures during pnpm install after upgrading, investigate whether lockfile entries are missing integrity fields by examining the pnpm-lock.yaml for entries without an integrity: key. Tools like git diff on the lockfile can help identify recent removals of integrity fields, which would be a red flag for tampering. Consider adding pre-commit hooks or CI checks to reject lockfile modifications that remove integrity checksums.

Why prioritize this

This vulnerability should be prioritized for patching because it affects supply chain security at the package level and enables code injection if the attack prerequisites are met. Organizations with many pnpm projects, strong code review discipline, and secure repository access may face lower immediate risk, but those with looser access controls, legacy projects, or high-value targets (e.g., shared libraries, internal packages) should patch urgently. The MEDIUM severity and low active exploitation rate should not lead to complacency; supply chain attacks are increasingly common and harder to detect than direct code vulnerabilities.

Risk score, explained

The CVSS 6.8 (MEDIUM) score balances high impact (confidentiality and integrity of installed packages) against moderate attack complexity and the requirement for privileged access. The score does not account for the criticality of the software supply chain or the potential for widespread downstream damage if a widely-used package is compromised. For organizations where pnpm is central to their build infrastructure, the business risk may exceed the numerical CVSS score.

Frequently asked questions