npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-224P-V68G-5G8FMedium@escape.tech/graphql-armor-max-depth: GraphQL Armor Max-Depth Plugin Bypass via fragment cachingGHSA-HMFR-RX46-4JX2Medium@escape.tech/graphql-armor-max-depth: GraphQL Armor Max-Depth Plugin Bypass via Introspection Query ObfuscationCVE-2025-57810Highjspdf: jsPDF Denial of Service (DoS)CVE-2025-57814Mediumrequest-filtering-agent: request-filtering-agent SSRF Bypass via HTTPS Requests to 127.0.0.1CVE-2025-43761Mediumcom.liferay:com.liferay.frontend.editor.ckeditor.web: Liferay Portal Reflected XSS in CKeditor 4.21.0 endpointCVE-2025-57755High@musistudio/claude-code-router: @musistudio/claude-code-router has improper CORS configurationCVE-2025-57753Mediumvite-plugin-static-copy: vite-plugin-static-copy files not included in `src` are possible to access with a crafted requestCVE-2025-9288Criticalsha.js: sha.js is missing type checks leading to hash rewind and passing on crafted dataCVE-2025-9287Criticalcipher-base: cipher-base is missing type checks, leading to hash rewind and passing on crafted dataCVE-2025-9262Low@wong2/mcp-cli: wong2 mcp-cli Command Injection VulnerabilityGHSA-3J63-5H8P-GF7CHighx402: x402 SDK vulnerable in outdated versions in resource servers for buildersCVE-2025-57749Mediumn8n: n8n symlink traversal vulnerability in "Read/Write File" node allows access to restricted filesCVE-2025-55746Criticaldirectus: Directus allows unauthenticated file upload and file modification due to lacking input sanitizationCVE-2025-50864Medium@elysiajs/cors: elysia-cors Origin Validation ErrorCVE-2025-55294Criticalscreenshot-desktop: screenshot-desktop vulnerable to command Injection via `format` optionCVE-2025-54881Mediummermaid: Mermaid improperly sanitizes sequence diagram labels leading to XSSCVE-2025-54880Mediummermaid: Mermaid does not properly sanitize architecture diagram iconText leading to XSSCVE-2025-55303Medium@astrojs/node: Astro allows unauthorized third-party images in _image endpointCVE-2025-52478Highn8n: Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/sourceCVE-2025-55284High@anthropic-ai/claude-code: Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude CodeCVE-2025-9096Mediumexpress-gateway: ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.jsCVE-2025-9095Mediumexpress-gateway: ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.jsCVE-2025-55285Low@backstage/plugin-scaffolder-backend: Template Secret leakage in logs in Scaffolder when using `fetch:template`CVE-2025-55207Medium@astrojs/node: @astrojs/node's trailing slash handling causes open redirect issueCVE-2025-8943Criticalflowise: Flowise OS command remote code execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo