npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-24046High@backstage/backend-defaults: Backstage has a Possible Symlink Path Traversal in Scaffolder ActionsCVE-2026-23957Highseroval: Seroval affected by Denial of Service via Array serializationCVE-2026-23956Highseroval: seroval affected by Denial of Service via RegExp serializationGHSA-H3HW-29FV-2X75High@envelop/graphql-modules: @envelop/graphql-modules has a Race Condition vulnerabilityCVE-2026-23965Highsm-crypto: sm-crypto Affected by Signature Forgery in SM2-DSACVE-2026-23967Highsm-crypto: sm-crypto Affected by Signature Malleability in SM2-DSACVE-2026-23966Criticalsm-crypto: sm-crypto Affected by Private Key Recovery in SM2-PKECVE-2026-23737Highseroval: seroval Affected by Remote Code Execution via JSON DeserializationCVE-2026-23736Highseroval: seroval Affected by Prototype Pollution via JSON DeserializationCVE-2026-23950Hightar: Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFSCVE-2026-23947Critical@orval/core: Orval has a code injection via unsanitized x-enum-descriptions in enum generationCVE-2026-21852Medium@anthropic-ai/claude-code: Claude Code Leaks Data via Malicious Environment Configuration Before Trust ConfirmationCVE-2026-1245Mediumbinary-parser: binary-parser library has a code injection vulnerabilityCVE-2025-66803Low@hotwired/turbo: Turbo Frame responses can restore stale session cookiesCVE-2026-23733Critical@lobehub/chat: Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)CVE-2026-23522Low@lobehub/chat: Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionCVE-2026-22037High@fastify/express: @fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)CVE-2026-22031High@fastify/middie: Fastify Middie Middleware Path BypassCVE-2025-15536Lowopencc: Open Chinese Convert has Out-of-bounds WriteCVE-2026-23745Hightar: node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationCVE-2026-23744Critical@mcpjam/inspector: REC in MCPJam inspector due to HTTP Endpoint exposesCVE-2026-23735Highgraphql-modules: GraphQL Modules has a Race Condition issueGHSA-38CW-85XC-XR9XMedium@veramo/data-store: Veramo is Vulnerable to SQL Injection in Veramo Data Store ORMGHSA-GW32-9RMW-QWWWHighsvelte: svelte is vulnerable to XSS with textarea bind:valueCVE-2025-15104Mediumnu.validator:validator: Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo