pnpm vulnerabilities

Recent CVEs affecting pnpm products. 16 tracked.

pnpm has 16 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 16. Most recent: 2026-07-06. Highest priority: CVE-2026-50016 (score 47/100).

• CVE-2026-59195 HIGH 8.2 UPGRADE pnpm is a package manager
• CVE-2026-59196 HIGH 7.1 UPGRADE pnpm is a package manager
• CVE-2026-59194 HIGH 7.1 UPGRADE pnpm is a package manager
• CVE-2026-50017 MEDIUM 6.5 UPGRADE pnpm is a package manager
• CVE-2026-55697 HIGH 7.5 UPGRADE pnpm is a package manager
• CVE-2026-55698 HIGH 8.8 UPGRADE pnpm is a package manager
• CVE-2026-50016 HIGH 8.8 UPGRADE pnpm is a package manager
• CVE-2026-55700 HIGH 7.1 UPGRADE pnpm is a package manager
• CVE-2026-55699 MEDIUM 6.5 UPGRADE pnpm is a package manager
• CVE-2026-55487 HIGH 7.5 UPGRADE pnpm is a package manager
• CVE-2026-55180 MEDIUM 6.5 UPGRADE pnpm is a package manager
• CVE-2026-50573 MEDIUM 6.8 UPGRADE pnpm is a package manager
• CVE-2026-50021 MEDIUM 6.8 UPGRADE pnpm is a package manager
• CVE-2026-50015 HIGH 7.3 UPGRADE pnpm is a package manager
• CVE-2026-50014 MEDIUM 6.4 UPGRADE pnpm is a package manager
• CVE-2026-48995 HIGH 7.5 UPGRADE pnpm is a package manager

FAQ

How do I fix pnpm vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is pnpm being exploited right now?

None of the tracked pnpm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which pnpm CVE should I patch first?

CVE-2026-50016 currently ranks highest (47/100): pnpm is a package manager.

Products

• pnpm

RSS feed for pnpm · ← Back to latest CVEs