VDB
HIGH 7.5

GHSA-w4pp-8pjf-rmxw

pacote is vulnerable to Denial of Service (DoS) via the addGitSha function

Quick fix

GHSA-w4pp-8pjf-rmxw — pacote: upgrade to the fixed version with the command below. 

npm install pacote@21.5.1

Details

Versions of the package pacote from 11.2.7 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm / pacote
Introduced in: 11.2.7 Fixed in: 21.5.1
Fix npm install pacote@21.5.1

References