npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-69211Medium@nestjs/platform-fastify: Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)CVE-2025-69206Mediumhemmelig: hemmelig allows SSRF Filter bypass via Secret Request functionality CVE-2025-13158Criticalapidoc-core: apidoc-core has a prototype pollution vulnerability CVE-2025-68697Highn8n: Self-hosted n8n has Legacy Code node that enables arbitrary file read/write CVE-2025-68668Criticaln8n: n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node CVE-2025-61914Highn8n: n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox CVE-2025-25341Highlibxmljs: libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)CVE-2025-68665High@langchain/core: LangChain serialization injection vulnerability enables secret extraction CVE-2025-68475High@fedify/fedify: Fedify has ReDoS Vulnerability in HTML Parsing Regex CVE-2025-68613Criticaln8n: n8n Vulnerable to Remote Code Execution via Expression Injection GHSA-24V3-254G-JV85Low@tutao/tutanota-utils: Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature CVE-2025-68457Loworejime: Orejime has executable code in HTML attributes CVE-2025-68429Highstorybook: Storybook manager bundle may expose environment variables during build CVE-2025-68278Hightinacms: tinacms is vulnerable to arbitrary code execution CVE-2025-13321Lowmattermost-desktop: Mattermost Desktop App exposes sensitive information in its application logs CVE-2025-68154Highsysteminformation: systeminformation has a Command Injection vulnerability in fsSize() function on Windows CVE-2025-68150Highparse-server: Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter CVE-2025-68155High@vitejs/plugin-rsc: @vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint GHSA-X732-6J76-QMHMHighbetter-auth: Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits CVE-2025-68130High@trpc/server: tRPC has possible prototype pollution in `experimental_nextAppDirCaller`CVE-2025-68115Mediumparse-server: Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables CVE-2025-68113Mediumaltcha-lib: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay CVE-2025-66482Mediummisskey-js: Misskey has a login rate limit bypass via spoofed X-Forwarded-For header CVE-2025-66402Highmisskey-js: misskey.js's export data contains private post data CVE-2025-67898Mediummjml: MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.