CVE-2026-9496: lerna
CVSS: 8.7v4.0HighAwaiting analysis
AliasesRHSA-2026:72116UBUNTU-CVE-2026-9496DEBIAN-CVE-2026-9496CGA-6hg7-665w-29r8CGA-qvc2-7vvp-4vjcCGA-v7gc-pppj-c5jxCGA-w3v3-fjgp-62xxGHSA-w4pp-8pjf-rmxwCGA-m8j9-wxwm-h988CGA-mc3v-9hh5-gj2cCGA-q84r-5645-qxq8CGA-xprh-frg8-568r
Published 26-05-2026Last modified 07-07-2026
Vulnerability summary
CVE-2026-9496 is a high (CVSS 8.7) vulnerability in lerna. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.7% of scored vulnerabilities.
CVSS score
8.7/10
010
High · v4.0 (CVE.org)EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 16 · Related 11OPENSUSE-SU-2026:11121-1OPENSUSE-SU-2026:21058-1OPENSUSE-SU-2026:21236-1RHSA-2026:72497RHSA-2026:75864RHSA-2026:75870RHSA-2026:76750RHSA-2026:84589RHSA-2026:84703SUSE-SU-2026:22368-1SUSE-SU-2026:22565-1SUSE-SU-2026:2633-1SUSE-SU-2026:2647-1SUSE-SU-2026:2695-1SUSE-SU-2026:3929-1SUSE-SU-2026:3930-1CGA-W3CM-86FJ-2C95
Timeline
- 26-05-2026PublishedVulnerability first disclosed.
- 07-07-2026Last modifiedVulnerability information updated.
Description
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service (DoS) via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation logic, causing excessive CPU consumption and potentially stalling or crashing the process.
CVSS metrics
11 scores · 8 sources · 2 versionsHigh 8.7Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:PSources7 sources · 7.7–8.7
- OSV · UbuntuEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- OSV · DebianEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- OSV · NpmEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- OSV · ChainguardEcosystem advisory · calculated8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
- NVDNIST7.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
High 7.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
0.00 pp
From 0.35% on 20-09-2026
20-09-202620-10-2026
EPSS score0.35%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1333Inefficient Regular Expression ComplexityThe product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Chainguard3 products
- graalvm-25-ce-nodejs< 25.0.4.1-r2
- lerna< 10.0.1-r1
- prism< 5.16.0-r6
Wolfi2 products
- lerna< 10.0.1-r1
- prism< 5.16.0-r6
Debian1 product
- npmAll versions (No fix recorded) | < 12.0.2+ds1-1
Npm1 product
- pacote≥ 11.2.7, < 21.5.1
Redhat1 product
- grafana12.4< 0:12.4.10-0.8.hum1
Ubuntu1 product
- npmAll versions (No fix recorded)
6 vendors · 9 products
References
19 links- images.redhat.comARTICLE
Show all 19 references
- github.com/npm/pacotePACKAGE