CVE-2025-69263: pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies

January 7, 2026 (updated January 8, 2026)

HTTP tarball dependencies (and git-hosted tarballs) are stored in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed.

References

github.com/advisories/GHSA-7vhp-vf5g-r2fw
github.com/pnpm/pnpm
github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85
github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fw
nvd.nist.gov/vuln/detail/CVE-2025-69263

Code Behaviors & Features

Detect and mitigate CVE-2025-69263 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →