npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-25049Criticaln8n: n8n Has Expression Escape Vulnerability Leading to RCECVE-2026-23897Highapollo-server: Apollo Serve vulnerable to Denial of Service with `startStandaloneServer`CVE-2026-21893Criticaln8n: n8n Vulnerable to Command Injection in Community Package InstallationCVE-2025-61917Highn8n: n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task RunnerCVE-2026-25155Medium@builder.io/qwik-city: Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)CVE-2026-25149Low@builder.io/qwik-city: Qwik City Open Redirect via fixTrailingSlashCVE-2026-25151Medium@builder.io/qwik-city: Qwik City has a CSRF Protection Bypass via Content-Type Header ValidationCVE-2026-25150Critical@builder.io/qwik-city: Prototype Pollution via FormData Processing in Qwik CityCVE-2026-25148Medium@builder.io/qwik-city: Qwik SSR XSS via Unsafe Virtual Node SerializationCVE-2026-25547High@isaacs/brace-expansion: @isaacs/brace-expansion has Uncontrolled Resource ConsumptionCVE-2026-24887High@anthropic-ai/claude-code: Claude Code has a Command Injection in find Command Bypasses User Approval PromptCVE-2026-24053High@anthropic-ai/claude-code: Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File WritesCVE-2026-24052High@anthropic-ai/claude-code: Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled DomainsCVE-2026-1664Mediumagents: Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email RoutingCVE-2025-69983Highfuxa-server: FUXA allows Remote Code Execution (RCE) via the project import functionality.CVE-2025-69970Highfuxa-server: FUXA contains an insecure default configuration vulnerabilityCVE-2025-69981Highfuxa-server: FUXA contains an Unrestricted File Upload vulnerabilityCVE-2026-24884Highcompressing: Compressing Vulnerable to Arbitrary File Write via Symlink ExtractionCVE-2026-25157Highclawdbot: OpenClaw/Clawdbot has OS Command Injection via Project Root Path in sshNodeCommandCVE-2026-25253Highclawdbot: OpenClaw/Clawdbot has 1-Click RCE via Authentication Token Exfiltration From gatewayUrlCVE-2026-24763Highclawdbot: OpenClaw/Clawdbot Docker Execution has Authenticated Command Injection via PATH Environment VariableCVE-2026-25228Mediumsignalk-server: SignalK Server has Path Traversal leading to information disclosureCVE-2026-25224Lowfastify: Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamCVE-2026-25223Highfastify: Fastify's Content-Type header tab character allows body validation bypassCVE-2026-25521Criticallocutus: locutus is vulnerable to Prototype Pollution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo