pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

published 2025-04-23 18 mo ago modified 2026-06-22 4 mo ago also EUVD-2025-12168 , GHSA-8cc4-rfj6-fhg4

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name /node_modoules/, there are no version numbers for the libraries they refer to. This issue has been patched in version 10.0.0.

Patch / fix

fixed in 2

npm pnpm 10.0.0
pnpm pnpm 10.0.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-47829 updated 2025-11-21 cvss 6.5

pnpm: pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

Red Hat JBoss Enterprise Application Platform 8 org.keycloak-keycloak-parent Red Hat JBoss Enterprise Application Platform Expansion Pack org.keycloak-keycloak-parent
affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-23)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	pnpm	<10.0.0	10.0.0

Affected products

pnpm pnpm

Classification

Weakness

CWE-328 Use of Weak Hash

References

github.com /pnpm/pnpm/security/advisories/GHSA-8cc4-rfj6-fhg4
web, exploit, vendor-advisory
nvd.nist.gov /vuln/detail/CVE-2024-47829
advisory
github.com /pnpm/pnpm
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary