CVE-2026-9496 is a denial of service vulnerability in the pacote package versions up to 11.2.7. The flaw occurs in the addGitSha function, which processes the spec.rawSpec input using regex replacement and string manipulation. An attacker can supply a crafted spec.rawSpec value that causes excessive CPU consumption, potentially stalling or crashing the affected process. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. The package is cloud-hosted, and the vendor manages patching for this service. No known exploits in the wild have been reported.

Successful exploitation leads to denial of service by exhausting CPU resources, causing the affected process to stall or crash. This impacts availability but does not affect confidentiality or integrity. The vulnerability can be triggered remotely without authentication or user interaction.

A patch is available for this vulnerability. Since pacote is a cloud-hosted service, the vendor manages remediation and patch deployment server-side. Users should verify with the vendor advisory to confirm that their environment has been updated. No additional user action is required if the vendor has applied the patch.