Versions of the package pacote from 11.2.7 have a flaw in the addGitSha helper that processes a supplied spec.rawSpec value. The function performs a regex replacement and subsequent string manipulation that, when fed a specially crafted input, can trigger an excessive loop and consume large amounts of CPU time. The effect is a denial of service: the npm or Node.js process may stall or crash, disrupting software installation or deployment.

The affected product is the pacote library used within Node.js ecosystems, including the npm package “pacote” and its reference under org.webjars.npm. Vulnerable releases start at version 11.2.7 and continue to the most recent versions unless patched. Any system that relies on pacote to resolve or fetch Git dependencies is at risk if the version being used is within the affected range.

The CVSS score of 8.7 qualifies it as high severity, yet the EPSS score is unavailable and it is not listed in the CISA KEV catalog, suggesting no widely known exploits yet. An attacker can trigger the denial of service by supplying a malicious spec.rawSpec string that is then processed by addGitSha. The attack vector is likely local or remote when the application or build step processes untrusted dependency specifications.