CVE-2026-50017

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0

Description pnpm may send user-level unscoped npm authentication credentials to a registry specified in a repository-local .npmrc file. This occurs when a user's global configuration contains a default registry and an unscoped authToken, but the repository's .npmrc file only defines a different registry URL without providing its own authentication. During metadata or installation workflows, pnpm incorrectly binds the user's global unscoped credential to the repository-selected registry and transmits it within the Authorization header.

Recommendations Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later.