pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-101043 · CVE overview and exploitation status

EUVD-2026-87974

GHSA-49pq-2gf3-jw76

GHSA-vx52-2968-3vc6

cve-program · CVE-2026-101043

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
• https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings

euvd · EUVD-2026-87974

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
• https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings

nvd · CVE-2026-101043

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
• https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings

osv · GHSA-vx52-2968-3vc6

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
• https://github.com/pnpm/pnpm/pull/12871
• https://github.com/pnpm/pnpm/pull/12898
• https://github.com/pnpm/pnpm/commit/36928beae9afb64a2a6a1221df54e66d361320c8
• https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0170b18ae053aff093eea56368ba
• https://github.com/orgs/pnpm/discussions/13598
• https://github.com/pnpm/pnpm
• https://github.com/pnpm/pnpm/releases/tag/v10.34.5
• https://github.com/pnpm/pnpm/releases/tag/v11.11.0

No related changes are available here.