npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-69985Critical@frangoteam/fuxa: FUXA has JWT Authentication Bypass via HTTP Referer header spoofing CVE-2026-27574Critical@oneuptime/common: OneUptime:: node:vm sandbox escape in probe allows any project member to achieve RCE CVE-2026-25545Medium@astrojs/node: Astro has Full-Read SSRF in error rendering via Host: header injection CVE-2025-70058Highyapi-vendor: yapi disables TLS/SSL certificate validation via rejectUnauthorized: false in Axios HTTPS agent CVE-2026-27576Mediumopenclaw: OpenClaw: ACP prompt-size checks missing in local stdio bridge could reduce responsiveness with very large inputs CVE-2026-27492Mediumlettermint: Lettermint Node.js SDK leaks email properties to unintended recipients when client instance is reused CVE-2026-27488Mediumopenclaw: OpenClaw hardened cron webhook delivery against SSRF CVE-2026-27485Mediumopenclaw: OpenClaw: Reject symlinks in local skill packaging script CVE-2026-27484Lowopenclaw: OpenClaw Discord moderation authorization used untrusted sender identity in tool-driven flows CVE-2025-67438Medium@sync-in/server: Sync-in Server has a stored cross-site scripting (XSS) vulnerability CVE-2026-25896Criticalfast-xml-parser: fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVE-2026-2739Mediumbn.js: bn.js affected by an infinite loop CVE-2026-4040Mediumopenclaw: OpenClaw safeBins file-existence oracle information disclosure CVE-2026-31996Lowopenclaw: OpenClaw safeBins stdin-only bypass via sort output and recursive grep flags CVE-2026-32060Highopenclaw: OpenClaw has a path traversal in apply_patch could write/delete files outside the workspace CVE-2026-27210Mediumpannellum: Pannellum has a XSS vulnerability in hot spot attributes CVE-2026-27193High@feathersjs/authentication-oauth: Feathers exposes internal headers via unencrypted session cookie CVE-2026-27192High@feathersjs/authentication-oauth: Feathers has an origin validation bypass via prefix matching CVE-2026-27191High@feathersjs/authentication-oauth: Feathers has an open redirect in OAuth callback enables account takeover GHSA-88QP-P4QG-RQM6Medium@sveltejs/kit: CPU exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-VRHM-GVG7-FPCFMedium@sveltejs/kit: Memory exhaustion in SvelteKit remote form deserialization (experimental only)GHSA-33HQ-FVWR-56PMLowdevalue: devalue affected by CPU and memory amplification from sparse arrays GHSA-8QM3-746X-R74RLowdevalue: devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed CVE-2026-27125Mediumsvelte: Svelte SSR attribute spreading includes inherited properties from prototype chain CVE-2026-27212Criticalswiper: Prototype pollution in swiper

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.