CVE-2026-50573

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0

Description In non-frozen mode, pnpm install may accept new remote package content even after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. If a registry serves different metadata and tarball content for a package name and version already locked with an integrity value, pnpm reports an integrity mismatch but then performs a resolution repair. This process accepts the new integrity from the registry, updates the lockfile, installs the new content, and exits successfully, meaning the lockfile integrity check does not act as a hard stop by default.

This behavior can be exploited if a registry is compromised or if a registry mirror/proxy serves mutated package content. In such cases, a new environment (such as a new machine or a new team member onboarding) may install a malicious replacement package despite the presence of a lockfile with the original integrity.

Recommendations Update pnpm to version 10.34.0 or later. Update pnpm to version 11.4.0 or later. As a temporary mitigation, use the --frozen-lockfile flag during installation to ensure the process fails if an integrity mismatch is detected.