npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2025-59472Mediumnext: Next.js has Unbounded Memory Consumption via PPR Resume Endpoint CVE-2026-1513Highbillboard.js: billboard.js is vulnerable to XSS during chart option bindingCVE-2026-24909Medium@vltpkg/tar: vlt Mishandles Path Sanitization for tarCVE-2026-24134Mediumstudiocms: StudioCMS has Authorization Bypass Through User-Controlled KeyCVE-2026-23830Critical@nyariv/sandboxjs: SandboxJS has Sandbox Escape via Unprotected AsyncFunction ConstructorCVE-2025-59471Mediumnext: Next.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configurationCVE-2026-24473Mediumhono: Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)CVE-2026-24472Mediumhono: Hono cache middleware ignores "Cache-Control: private" leading to Web Cache DeceptionCVE-2026-24398Mediumhono: Hono IPv4 address validation bypass in IP Restriction Middleware allows IP spoofingCVE-2026-1470Criticaln8n: n8n Unsafe Workflow Expression Evaluation Allows Remote Code ExecutionGHSA-CR3W-CW5W-H3FJCritical@saltcorn/server: Saltcorn's Reflected XSS and Command Injection vulnerabilities can be chained for 1-click-RCECVE-2026-24131Mediumpnpm: pnpm has Path Traversal via arbitrary file permission modification CVE-2026-23888Mediumpnpm: pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)CVE-2026-23889Mediumpnpm: pnpm has Windows-specific tarball Path TraversalCVE-2026-23890Mediumpnpm: pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.binCVE-2026-24056Mediumpnpm: pnpm has symlink traversal in file:/git dependenciesCVE-2026-22709Criticalvm2: vm2 has a Sandbox EscapeCVE-2026-22696Criticaldcap-qvl: dcap-qvl has Missing Verification for QE IdentityCVE-2026-24132High@orval/mock: Orval Mock Generation Code Injection via constCVE-2026-24006Highseroval: Seroval affected by Denial of Service via Deeply Nested ObjectsCVE-2025-65098High@typebot.io/js: Typebot affected by Credential Theft via Client-Side Script Execution and API Authorization BypassCVE-2025-13465Mediumlodash: Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functionsCVE-2026-0933Highwrangler: Wrangler affected by OS Command Injection in `wrangler pages deploy`CVE-2026-24048Low@backstage/backend-defaults: Backstage has a Possible SSRF when reading from allowed URL's in `backend.reading.allow`CVE-2026-24047Medium@backstage/cli-common: @backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo