Authentication Bypass via Peer Dependency Normalization in pnpm

Executive Summary

CVE-2026-55487 is a high-severity vulnerability in the pnpm package manager affecting versions prior to 10.34.2 and 11.5.3. The issue arises from the generic peer-suffix normalizer stripping parenthesized text from various opaque locators such as git URLs, tarballs, and file paths. This normalization flaw allows an attacker to spoof manifest identities by making different source locators appear identical after normalization.

As a result, an attacker can bypass build approvals intended for one source string and instead authorize a different attacker-controlled source that normalizes to the same value. This can lead to unauthorized execution of attacker-controlled lifecycle scripts during builds.

The vulnerability was fixed by enforcing exact byte-for-byte matching of resolved dependency identities, preventing collisions caused by parenthesized suffixes, misclassified URLs, and semver-like tails.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to bypass build approval mechanisms in pnpm, leading to the execution of unauthorized, attacker-controlled lifecycle scripts during your software builds.

Such unauthorized script execution can compromise the confidentiality, integrity, and availability of your software supply chain, potentially introducing malicious code or disrupting your build processes.

Because the attack vector is network-based and requires user interaction but no privileges, it poses a significant risk especially in environments where dependencies are automatically approved or built.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability affects pnpm package manager versions prior to 10.34.2 and 11.5.3, specifically those versions that allow manifest identity spoofing through normalization of opaque dependency locators.

To detect if your system is vulnerable, check the installed pnpm version to see if it falls within the affected ranges.

• Run `pnpm --version` to determine the installed pnpm version.

Additionally, review your build approval logs or ignored-build outputs for any suspicious normalized locators that could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade pnpm to a fixed version.

• Upgrade pnpm to version 10.34.2 or later, or 11.5.3 or later, where the vulnerability is patched.

These versions enforce exact byte-for-byte matching of resolved dependency identities, preventing unauthorized execution of attacker-controlled lifecycle scripts.

Until upgrading, carefully audit build approvals and dependency sources to detect any suspicious or unauthorized locators.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in pnpm allows attackers to bypass build approvals and execute unauthorized attacker-controlled lifecycle scripts during builds by exploiting manifest identity spoofing. This can lead to unauthorized code execution and potential compromise of the build environment.

Such unauthorized execution and potential compromise could impact the confidentiality, integrity, and availability of software supply chains, which are critical aspects of compliance with standards like GDPR and HIPAA that require protection of data and system integrity.

However, the provided information does not explicitly detail the direct effects on compliance with these regulations.

Useful 0 Not Useful 0