CVE-2026-59194 pnpm vulnerability

Who is affected

How to fix it

pnpm is affected by CVE-2026-59194, a path traversal and arbitrary file operation risk. pnpm is a package manager. The recommended remediation is to update to pnpm 10.34.4, pnpm 11.7.0, or a later fixed release for the deployed major branch. Until the update is complete, avoid running pnpm patch-remove on untrusted patch entries and review configured patch paths, review logs, and reduce exposure of the affected package, route, provider, or service workflow.

1. Inventory every deployment, package, dependency, build runner, integration, route, service, and managed environment that uses pnpm.
2. Confirm the installed version/build and compare it with versions prior to 10 and the source advisory for CVE-2026-59194.
3. Apply the vendor-supported fix: update to pnpm 10.34.4, pnpm 11.7.0, or a later fixed release for the deployed major branch.
4. If the update cannot be applied immediately, avoid running pnpm patch-remove on untrusted patch entries and review configured patch paths; disable unnecessary public access, package-install paths, file processing, webhooks, message consumers, or high-risk integrations until patched.
5. Review application, CI/CD, package manager, container, reverse-proxy, WAF, authentication, route, and audit logs for activity related to CVE-2026-59194.
6. Rotate sessions, API tokens, package registry credentials, cloud credentials, webhook secrets, service credentials, and administrator passwords if logs or affected data indicate compromise, credential exposure, or unauthorized access.
7. Clear caches, restart affected services, rebuild affected containers or build agents when appropriate, and remove temporary files, malicious artifacts, stored payloads, or unsafe configuration created during exploitation attempts.

Verify the fix

• Confirm pnpm now reports pnpm 10.34.4, pnpm 11.7.0, or a later fixed release for the deployed major branch or a later vendor-supported fixed release/build for the deployed branch.
• Verify the affected workflow no longer allows the behavior described in CVE-2026-59194, using a safe regression test, dependency inventory, or vendor validation method.
• Review logs after remediation for continued exploit attempts, denial-of-service symptoms, suspicious redirects, unauthorized requests, path traversal, header manipulation, credential exposure, or configuration changes.
• Rerun a Fixnx scan and any product-specific scanner, package audit, dependency check, route regression test, or integration test relevant to the affected service.
• Document affected assets, fixed versions, mitigation decisions, validation evidence, and any cleanup, rebuild, or credential rotation performed.

Trusted references

FAQ