npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-107383Highmariadb: MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersCVE-2026-107382Mediummariadb: MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSCVE-2026-107392Mediummusic-metadata: music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)CVE-2026-106444Mediumhandlebars: Handlebars: JavaScript Injection via Unsafe Inline Embedding of Precompiled TemplatesCVE-2026-106446Criticalhandlebars: Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937)CVE-2026-106445Criticalhandlebars: Handlebars: JavaScript Injection via Own Property Check BypassCVE-2026-106119Medium@langchain/mongodb: LangChain: MongoDBChatMessageHistory query injection can allow cross-session accessCVE-2026-107375Highgenerator-jhipster: JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) ApplicationssortCVE-2026-107303Highgenerator-jhipster: JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin BlobCVE-2026-107302Highmsgpack5: msgpack5: Truncated map32 headers throw an unexpected errorCVE-2026-107300Highmsgpack5: msgpack5: Many buffered values can exhaust the streaming decoder stackCVE-2026-107299Mediummsgpack5: msgpack5: Reserved byte can cause unbounded stream bufferingCVE-2026-107301Mediummsgpack5: msgpack5: Partial options disable prototype protectionCVE-2026-107298Mediummsgpack5: msgpack5: Deeply nested input can exhaust the decoder stackCVE-2026-107297Mediummsgpack5: msgpack5: Quadratic parsing in the streaming decoderCVE-2026-107296Lowmsgpack5: msgpack5: Decoding negative int64 values mutates the input bufferCVE-2026-105642Highghost: Ghost: Remote Code Execution via Bookmark Card ImagesCVE-2026-105643Highghost: Ghost: Stored XSS via Embed Card PreviewsCVE-2026-105644Mediumghost: Ghost : Stored XSS via SVG Files in Content ImportsCVE-2026-105645Mediumghost: Ghost: Regular Expression Denial of Service in External Media InlinerCVE-2026-105646Mediumghost: Ghost: Regular Expression Denial of Service in Content ImportCVE-2026-105647Mediumghost: Ghost: Server-Side Request Forgery in Bookmark FetchingCVE-2026-105648Mediumghost: Ghost: Private IP Filtering Bypass via IPv6 Transition AddressesCVE-2026-105649Highghost: Ghost: Stored XSS via SVG Uploads Bypassing SanitizationCVE-2026-94544Mediumnext: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo