npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-31865Mediumelysia: Elysia Cookie Value Prototype PollutionCVE-2026-29057Mediumnext: Next.js: HTTP request smuggling in rewritesCVE-2026-27980Mediumnext: Next.js: Unbounded next/image disk cache growth can exhaust storageCVE-2026-27979Mediumnext: Next.js: Unbounded postponed resume buffering can lead to DoSCVE-2026-27978Mediumnext: Next.js: null origin can bypass Server Actions CSRF checksCVE-2026-27977Lownext: Next.js: null origin can bypass dev HMR websocket CSRF checksCVE-2026-4258Highsjcl: sjcl is missing point-on-curve validation in sjcl.ecc.basicKey.publicKeyCVE-2026-33572Mediumopenclaw: OpenClaw session transcript files were created without forced user-only permissionsGHSA-G2F6-PWVX-R275Highopenclaw: OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injectionCVE-2026-32980Highopenclaw: OpenClaw Telegram webhook request bodies were read before secret validation, enabling unauthenticated resource exhaustionGHSA-63F5-HHC7-CX6PHighopenclaw: OpenClaw bootstrap setup codes could be replayed to escalate pending pairing scopes before approvalGHSA-XWCJ-HWHF-H378Mediumopenclaw: OpenClaw Telegram media fetch errors exposed bot tokens in logged file URLsCVE-2026-32728Highparse-server: Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entriesCVE-2026-32723Medium@nyariv/sandboxjs: SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timersCVE-2026-32732Low@leanprover/unicode-input-component: XSS in @leanprover/unicode-input-componentCVE-2026-32638Lowstudiocms: StudioCMS REST getUsers Exposes Owner Account Records to Admin TokensCVE-2026-29112High@dicebear/converter: Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converterCVE-2026-32774Mediumvulnogram: Vulnogram contains a stored cross-site scripting vulnerability in comment hypertext handlingCVE-2026-4092High@google/clasp: @google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious scriptCVE-2026-32635High@angular/core: Angular vulnerable to XSS in i18n attribute bindingsCVE-2026-32630Mediumfile-type: file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entryCVE-2026-34505Mediumopenclaw: OpenClaw: Zalo webhook rate limiting could be bypassed before secret validationCVE-2026-32974Highopenclaw: OpenClaw: Feishu webhook mode accepted forged events when only `verificationToken` was configuredGHSA-2RQG-GJGV-84JMHighopenclaw: OpenClaw: Gateway `agent` calls could override the workspace boundaryCVE-2026-22172Criticalopenclaw: OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo