npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-66479Low@anthropic-ai/sandbox-runtime: Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing CVE-2025-65945Highjws: auth0/node-jws Improperly Verifies HMAC Signature CVE-2025-66404Mediummcp-server-kubernetes: mcp-server-kubernetes has potential security issue in exec_in_pod tool GHSA-FMH4-WR37-44FPCritical@vitejs/plugin-rsc: React Server Components are Vulnerable to RCE CVE-2025-55182Criticalreact-server-dom-webpack: React Server Components are Vulnerable to RCE GHSA-9QR9-H5GF-34MPCriticalnext: Next.js is vulnerable to RCE in React flight protocol CVE-2025-66032High@anthropic-ai/claude-code: Claude Code Command Validation Bypass Allows Arbitrary Code Execution CVE-2025-66414High@modelcontextprotocol/sdk: Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default CVE-2025-66400Mediummdast-util-to-hast: mdast-util-to-hast has unsanitized class attribute CVE-2025-66412High@angular/compiler: Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes CVE-2025-66405Medium@portkey-ai/gateway: Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host CVE-2025-66415Medium@fastify/reply-from: fastify-reply-from affected by bypass of reply forwarding CVE-2025-66401Criticalmcp-watch: MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL CVE-2025-71401Highbetter-auth: Better Auth affected by external request basePath modification DoS CVE-2025-14874Highnodemailer: Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls CVE-2025-66420Mediumtryton-sao: Tryton sao allows XSS via an HTML attachment CVE-2025-66421Mediumtryton-sao: Tryton sao allows XSS because it does not escape completion values CVE-2025-12758Highvalidator: Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements CVE-2025-66035High@angular/common: Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client GHSA-WMJR-V86C-M9JJLowbetter-auth: Better Auth's multi-session sign-out hook allows forged cookies to revoke arbitrary sessions CVE-2025-66219Mediumwillitmerge: willitmerge has a Command Injection vulnerability CVE-2025-66031Highnode-forge: node-forge has ASN.1 Unbounded Recursion CVE-2025-66030Mediumnode-forge: node-forge is vulnerable to ASN.1 OID Integer Truncation CVE-2025-12816Highnode-forge: node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization CVE-2025-66020Highvalibot: Valibot has a ReDoS vulnerability in `EMOJI_REGEX`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.