npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-11148Criticalcheck-branches: check-branches is vulnerable to command Injection CVE-2025-11149High@nubosoftware/node-static: @nubosoftware/node-static failure to catch exception can result in server crash CVE-2025-3193Mediumalgoliasearch-helper: algoliasearch-helper is vulnerable to Prototype Pollution in _merge()CVE-2025-59845High@apollo/sandbox: Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass CVE-2025-59364Mediumexpress-xss-sanitizer: express-xss-sanitizer has an unbounded recursion depth CVE-2025-59936Criticalget-jwks: get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass CVE-2020-36851Criticalcors-anywhere: cors-anywhere vulnerable to server-side request forgery CVE-2025-57317Highapidoc-core: apidoc-core is vulnerable to prototype pollution CVE-2025-26278Highdref: dref is vulnerable to prototype pollution CVE-2025-59426Medium@lobehub/chat: lobe-chat has an Open Redirect CVE-2025-57324Mediumparse: parse is vulnerable to prototype pollution CVE-2025-57326Lowsassdoc-extras: sassdoc-extras vulnerable to prototype pollution CVE-2025-57321Lowmagix-combine-ex: magix-combine-ex vulnerable to prototype pollution CVE-2025-57327Lowspmrc: spmrc vulnerable to prototype pollution CVE-2025-57318Highcsvjson: csvjson vulnerable to prototype injection CVE-2025-57323Highmpregular: mpregular vulnerable to prototype pollution CVE-2025-57349Lowmessageformat: messageformat has a prototype pollution vulnerability CVE-2025-57329Lowweb3-core-method: web3-core-method is vulnerable to prototype pollution CVE-2025-57320Mediumjson-schema-editor-visual: json-schema-editor-visual vulnerable to prototype pollution CVE-2025-57328Lowtoggle-array: toggle-array vulnerable to prototype pollution CVE-2025-57348Lownode-cube: node-cube vulnerable to prototype pollution CVE-2025-57330Lowweb3-core-subscriptions: web3-core-subscriptions has a Prototype Pollution vulnerability CVE-2025-57351Mediumts-fns: ts-fns has prototype pollution vulnerability CVE-2025-61685Medium@mastra/mcp-docs-server: Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure CVE-2025-59834Criticaladb-mcp: Command Injection in adb-mcp MCP Server

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo