npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-84994High@builder.io/qwik: Qwik: Crashing any Qwik Server via Resource thenableCVE-2026-106495Medium@backstage/backend-defaults: Backstage: Improper access control in backend action invocationCVE-2026-103975Medium@appium/support: Appium: Symlink based Zip Slip in @appium/support ZIP extractionCVE-2026-102527Mediumnuxt-og-image: Nuxt OG Image cache poisoning through derivable cache keys on unsigned dynamic image routesCVE-2026-100409High@opennextjs/cloudflare: OpenNext Cloudflare: Cache interception can bypass middleware protection for encoded pathsCVE-2026-104150Medium@adonisjs/http-server: AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression ComplexityCVE-2026-110644Criticalnodejs-whisper: nodejs-whisper allows OS command injection through crafted audio file pathsCVE-2026-110634Criticalgit-diff: git-diff: OS command injection vulnerability via crafted strings to the gitDiff APICVE-2026-108259High@tinacms/cli: Tina: Code injection via unescaped Git branch name in generated client sourceCVE-2026-108261Criticaltinacms: TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragmentCVE-2026-108260High@tinacms/web-components: @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSSCVE-2026-107719Mediumfast-jwt: fast-jwt: Verifier cache accepts expired JWTs without iat.CVE-2026-107718Medium@adonisjs/http-server: AdonisJS: Unencoded route parameters can produce open redirectsCVE-2026-107720Highfast-jwt: fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly setCVE-2026-107722Criticalfast-jwt: fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusionCVE-2026-107721Mediumfast-jwt: fast-jwt clockTolerance: Infinity silently bypasses both exp and nbf validation (and persists in the verifier cache)CVE-2026-107723Highfast-jwt: fast-jwt : Silent claim-validator bypass when JWT payload is a JSON arrayCVE-2026-107724Highfast-jwt: fast-jwt treats raw public JWK JSON as an HMAC secret, enabling HS256 token forgeryCVE-2026-61426Highpraisonai: PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosureCVE-2026-107391Mediummusic-metadata: music-metadata: MP4 stsd sample-entry size==0 causes a synchronous infinite loop (DoS) — unreleased regression on masterCVE-2026-107387Mediummusic-metadata: music-metadata: Uncontrolled memory allocation in APEv2 parserCVE-2026-107388Mediummusic-metadata: music-metadata: ID3v2 tag size not validated before allocation, causing memory exhaustion DoSCVE-2026-107389Mediummusic-metadata: music-metadata: EBML parser trusts element lengths, allowing memory exhaustion or process abortCVE-2026-107385Highmariadb: MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESCVE-2026-107384Highmariadb: MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo