npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-93363Medium@payloadcms/storage-vercel-blob: @payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapterCVE-2026-113787Mediumodf-kit: odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute valuesCVE-2026-44267Critical@enspirit/elo: Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member accessCVE-2026-44266Critical@enspirit/elo: Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labelsCVE-2026-44265High@enspirit/elo: Elo backends have code injection via unvalidated emission of programmatic AST fieldsGHSA-J656-3HF2-FVJCMedium@bytebase/dbhub: DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validationCVE-2026-62374High@sd-jwt/decode: SD JWT JS: Tampered disclosures silently dropped instead of rejectedCVE-2026-118772Highjoi: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceCVE-2026-119202High@hapi/content: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of serviceCVE-2026-118764Mediumminimatch: minimatch has potential denial of service via globparts amplificationCVE-2026-118773Mediumglob: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversalCVE-2026-118775Lownode-forge: Forge: ASN.1 OID first arc truncation in asn1.oidToDerCVE-2026-118777Mediumnode-forge: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-CookieCVE-2026-118778Mediumnode-forge: Forge: TLS client crash when the server sends no certificateCVE-2026-118779Highnode-forge: Forge: Regular expression denial of service in PEM decoding (pem.decode)CVE-2026-118781Lownode-forge: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)CVE-2026-118780Lownode-forge: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA storeCVE-2026-119186Mediumnode-forge: Forge: AES-GCM authentication bypass via unvalidated tagLength optionCVE-2026-118782Highnode-forge: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration countCVE-2026-119188Highnode-forge: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake messageCVE-2026-119187Highnode-forge: Forge: Denial of service in TLS record processing via call stack exhaustionCVE-2026-119190Highnode-forge: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13CVE-2026-119201Medium@nuxt/vite-builder: Nuxt dev server exposes generated appSecret through Vite file servingCVE-2026-119200Mediumnuxt: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routesCVE-2026-119198Medium@nuxt/vite-builder: Nuxt dev server arbitrary file read through client error reports

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo