npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-XQ7H-VWJP-5VRHMedium@grackle-ai/powerline: @grackle-ai/powerline Runs Without Authentication by DefaultGHSA-W3HV-X4FP-6H6JHigh@grackle-ai/server: @grackle-ai/server has Missing WebSocket Origin Header ValidationGHSA-647H-P824-99W7High@grackle-ai/mcp: @grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP toolGHSA-7Q9X-8G6P-3X75Low@grackle-ai/server: @grackle-ai/server: Unescaped Error String in renderPairingPage() HTML TemplateCVE-2026-27496Highn8n: n8n has In-Process Memory Disclosure in its Task RunnerCVE-2026-26830Criticalpdf-image: pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameterCVE-2026-33627Highparse-server: Parse Server exposes auth data via /users/me endpointCVE-2026-33624Lowparse-server: Parse Server: MFA recovery code single-use bypass via concurrent requestsCVE-2026-29772Medium@astrojs/node: Astro: Memory exhaustion DoS due to missing request body size limit in Server IslandsCVE-2026-33539Highparse-server: Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapterCVE-2026-33538Highparse-server: Parse Server: Denial of Service via unindexed database query for unconfigured auth providersGHSA-G3QJ-J598-CXMQHighfido2-lib: fido2-lib is vulnerable to DoS via cbor-extract heap buffer over-read in CBOR attestation parsingCVE-2026-33527Mediumparse-server: Parse Server's Session Update endpoint allows overwriting server-generated session fieldsGHSA-FP4X-GGRF-WMC6Mediumh3: H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer ValidationCVE-2026-86250Mediumh3: H3: Unbounded Chunked Cookie Count in Session Cleanup Loop may Lead to Denial of ServiceCVE-2026-4600Highjsrsasign: jsrsasign: DSA signatures or X.509 certificates can be forged via DSA domain-parameter validation in KJUR.crypto.DSA.setPublicCVE-2026-4599Criticaljsrsasign: jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce GenerationCVE-2026-4603Lowjsrsasign: jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA OperationsCVE-2026-4602Highjsrsasign: jsrsasign: Negative Exponent Handling Leads to Signature Verification BypassCVE-2026-4598Highjsrsasign: jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputsCVE-2026-4601Highjsrsasign: jsrsasign: Missing cryptographic validation during DSA signing enables private key extractionCVE-2026-33508Highparse-server: Parse Server LiveQuery subscription query depth bypassCVE-2026-33498Highparse-server: Parse Server has a query condition depth bypass via pre-validation transform pipelineGHSA-4HXC-9384-M385Mediumh3: h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Data and Comment Fields (Bypass of CVE Fix)CVE-2026-33490Lowh3: h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo