The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-develUpgrade nodejs-packaging-bundlerUpgrade nodejs-docsUpgrade nodejs | Oct 11, 2026 | Oct 5, 2026 |
| Amazon_linux_2023 | — | Upgrade nodejs22-docsUpgrade nodejs24-debugsourceUpgrade nodejs24-debuginfoUpgrade v8-12.4-develUpgrade nodejs22-full-i18nUpgrade nodejs22Upgrade v8-13.6-develUpgrade nodejs22-debuginfoUpgrade nodejs24Upgrade nodejs24-develUpgrade nodejs24-libsUpgrade nodejs22-npmUpgrade nodejs24-libs-debuginfoUpgrade nodejs22-libsUpgrade nodejs24-npmUpgrade nodejs24-full-i18nUpgrade nodejs22-debugsourceUpgrade nodejs24-docsUpgrade nodejs22-libs-debuginfoUpgrade nodejs22-devel | Aug 18, 2026 | May 26, 2026 |
| Oracle_linux | — | Upgrade nodejs-packaging-bundlerUpgrade nodejs-libsUpgrade nodejsUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-develUpgrade v8-12.4-develUpgrade nodejs-packagingUpgrade nodejs-npmUpgrade nodejs-nodemon | Oct 22, 2026 | May 26, 2026 |
| Redhat_linux | — | Upgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs22-debuginfoUpgrade v8-12.4-develUpgrade nodejs-npmNo solution existsUpgrade nodejs-libsUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs22-debugsourceUpgrade nodejs-packaging-bundlerUpgrade nodejs-packagingUpgrade nodejs-libs-debuginfoUpgrade nodejsUpgrade nodejs-devel | Sep 25, 2026 | May 26, 2026 |
| Rocky_linux | — | Upgrade nodejs-develUpgrade nodejs-npmUpgrade nodejs-debugsourceUpgrade nodejs22-debuginfoUpgrade nodejs-libs-debuginfoUpgrade v8-12.4-develUpgrade nodejs-libsUpgrade nodejs-debuginfoUpgrade npmUpgrade nodejs-full-i18nUpgrade nodejsUpgrade nodejs22-debugsource | Oct 7, 2026 | Oct 6, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub