HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-50573 — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-fr...

·Source: NIST NVD

Updated:

Executive Summary

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm

Analysis

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, `pnpm install` in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the registry later serves different metadata and tarball content for the same package name and version, pnpm initially reports an integrity mismatch. However, plain pnpm install then performs a resolution repair, accepts the registry's new integrity, updates the lockfile, installs the new content, and exits successfully. This means the lockfile integrity check does not act as a hard stop by default. This vulnerability is fixed in 10.34.0 and 11.4.0. CVSS Score: 6.8. Published: 2026-06-25T18:16:39.687.

Indicators of Compromise (1)

CVE (1)
CVE-2026-50573
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

ANCHOR-CI Framework Strengthens Partnerships and Information Sharing to Secure Critical Infrastructure

The Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) has announced the formation of the Alliance of […] The post ANCHOR-CI Framework Strengthens Partnerships and Information Sharing to Secure Critical Infrastructure appeared first on The HIPAA Journal .

HIPAA Journal
MEDIUMVulnerability

Starling to axe 130 jobs as part of automation drive

UK challenger bank Starling has announced plans to cut more than 100 jobs as part of an efficiency drive.

Finextra
MEDIUMVulnerability

ToneTag launches voice-first bank assistant for Indian market

ToneTag, India’s deep-tech platform, today announced the launch of eKosha, a voice-first business assistant for merchants that enables banks to deliver a full range of merchant banking services directly at the merchant counter without requiring new infrastructure investment.

Finextra