Packages / pnpm / Security

HighVulnerabilityGHSA-7vhp-vf5g-r2fwPublished 7 Jan 2026

pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

Affected · pnpm

  • < 10.26.0

Fixed in

10.26.0

npm install pnpm@10.26.0

  1. Affected

    0.0.1 – 10.25.0

    915 releases

  2. Fixed

    10.26.0 – 12.14.0

    115 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.