npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-25153High@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooksCVE-2026-25142Critical@nyariv/sandboxjs: SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCECVE-2026-24737Highjspdf: jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript ExecutionCVE-2026-24133Highjspdf: jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoderCVE-2026-24043Mediumjspdf: jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)CVE-2026-24040Mediumjspdf: jsPDF has Shared State Race Condition in addJS PluginCVE-2026-23515Critical@signalk/set-system-time: Signal K set-system-time plugin vulnerable to RCE - Command InjectionCVE-2026-25152Medium@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local GeneratorCVE-2026-23835Medium@lobehub/chat: LobeHub Vulnerable to Improper Authorization in Presigned UploadCVE-2026-25141Critical@orval/core: Orval has Code Injection via unsanitized x-enum-descriptions using JS commentsCVE-2026-25128Highfast-xml-parser: fast-xml-parser has RangeError DoS Numeric Entities BugCVE-2026-25050Low@vendure/core: Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategyCVE-2026-25047Criticaldeephas: deepHas vulnerable to Prototype Pollution via constructor.prototypeCVE-2026-24888Mediummakerjs: Maker.js has Unsafe Property Copying in makerjs.extendObjectCVE-2026-23864Highreact-server-dom-parcel: React Server Components have multiple Denial of Service VulnerabilitiesCVE-2026-24766Mediumnocodb: NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoSCVE-2026-24767Mediumnocodb: NocoDB has Blind SSRF via Unvalidated HEAD Request in uploadViaURL FunctionalityCVE-2026-24768Mediumnocodb: NocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn ParameterCVE-2026-24769Highnocodb: NocoDB Vulnerable to Stored Cross-Site Scripting via SVG uploadCVE-2025-61140Mediumjsonpath: JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.jsCVE-2025-57283Mediumbrowserstack-local: BrowserStack Local vulnerable to Command Injection through logfile variableCVE-2026-24842Hightar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path TraversalCVE-2026-24778Highghost: Ghost vulnerable to XSS via malicious Portal preview linksCVE-2026-24771Mediumhono: Hono vulnerable to XSS through ErrorBoundary component GHSA-H25M-26QC-WCJFHighnext: Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo