npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-22775Highdevalue: devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseCVE-2026-23634Lowpepr: Pepr Has Overly Permissive RBAC ClusterRole in Admin ModeCVE-2025-15265Mediumsvelte: svelte vulnerable to Cross-site ScriptingCVE-2026-23527Highh3: h3 v1 has Request Smuggling (TE.TE) issueCVE-2026-22803High@sveltejs/kit: @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)CVE-2026-22774Highdevalue: Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parseCVE-2025-67647High@sveltejs/kit: SvelteKit is vulnerable to denial of service and possible SSRF when using prerenderingCVE-2026-24001Lowdiff: jsdiff has a Denial of Service vulnerability in parsePatch and applyPatchCVE-2026-22036Mediumundici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustionCVE-2026-22787Highhtml2pdf.js: html2pdf.js contains a cross-site scripting vulnerabilityCVE-2026-22686Criticalenclave-vm: enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype ChainCVE-2026-22820Mediumoutray: Outray cli is vulnerable to race conditions in tunnels creationCVE-2026-22819Mediumoutray: Outray has a Race Condition in the cli's webappCVE-2026-22818Highhono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks "alg" (untrusted header.alg fallback)CVE-2026-22817Highhono: Hono JWT Middleware's JWT Algorithm Confusion via Unsafe Default (HS256) Allows Token Forgery and Auth BypassCVE-2025-15056Lowquill: Quill is vulnerable to XSS via HTML export featureCVE-2026-22814High@adonisjs/lucid: Mass Assignment in AdonisJS Lucid Allows Overwriting Internal ORM StateCVE-2026-22813Criticalopencode-ai: Malicious website can execute commands on the local system through XSS in the OpenCode web UICVE-2026-22809Mediumtarteaucitronjs: tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2026-22812Highopencode-ai: OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command ExecutionGHSA-3F44-XW83-3PMGMediumrenovate: Renovate vulnerable to arbitrary command injection via helmv3 manager and malicious Chart.yaml fileGHSA-XJR7-3C3G-M763Mediumrenovate: Renovate vulnerable to arbitrary command injection via gleam manager and malicious gleam.toml fileGHSA-36J9-MX87-2CFFMediumrenovate: Renovate vulnerable to arbitrary command injection via hermit manager and maliciously named dependenciesGHSA-FR4J-65PV-GJJJMediumrenovate: Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configurationGHSA-XV56-3WQ5-9997Mediumrenovate: Renovate vulnerable to arbitrary command injection via kustomize manager and malicious helm repository

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo