diff --git a/.changeset/healthy-masks-rescue.md b/.changeset/healthy-masks-rescue.md
new file mode 100644
index 0000000000..d57339b316
--- /dev/null
+++ b/.changeset/healthy-masks-rescue.md
@@ -0,0 +1,6 @@
+---
+"@pnpm/plugin-commands-audit": patch
+"pnpm": patch
+---
+
+`pnpm audit --fix` should not add an override for a vulnerable package that has no fixes released.
diff --git a/packages/plugin-commands-audit/src/fix.ts b/packages/plugin-commands-audit/src/fix.ts
index 53a42bcf39..e5ec978dac 100644
--- a/packages/plugin-commands-audit/src/fix.ts
+++ b/packages/plugin-commands-audit/src/fix.ts
@@ -22,7 +22,7 @@ export default async function fix (dir: string, auditReport: AuditReport) {
 function createOverrides (advisories: AuditAdvisory[]) {
   return fromPairs(
     advisories
-      .filter(({ vulnerable_versions }) => vulnerable_versions !== '>=0.0.0') // eslint-disable-line
+      .filter(({ vulnerable_versions, patched_versions }) => vulnerable_versions !== '>=0.0.0' && patched_versions !== '<0.0.0') // eslint-disable-line
       .map((advisory) => [
         `${advisory.module_name}@${advisory.vulnerable_versions}`,
         advisory.patched_versions,