pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field (CVE-2026-50021)

pnpm's tarball extraction worker skips integrity verification if the integrity field is absent from the lockfile resolution prior to versions 10.34.0 and 11.4.0. An attacker who can modify pnpm-lock.yaml to remove the integrity field and control the registry URL content can cause pnpm install --frozen-lockfile to install tampered packages without triggering integrity errors. This behavior is a fail-open gap unique to pnpm, as npm enforces integrity verification by default. The vulnerability is addressed in pnpm versions 10.34.0 and 11.4.0.

An attacker able to modify the pnpm-lock.yaml file and the referenced registry URL can cause pnpm to install maliciously altered packages without integrity verification errors. This can lead to the execution of compromised code with the privileges of the user running pnpm. The vulnerability affects confidentiality and integrity but not availability. There are no known exploits in the wild at this time.

Upgrade pnpm to version 10.34.0 or later, or 11.4.0 or later, where this integrity check bypass vulnerability is fixed. Until then, be cautious of lockfile modifications and untrusted registry sources. No other vendor advisories indicate alternative mitigations or that the issue is already mitigated.