npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-55164Highcontent-security-policy-parser: content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE CVE-2025-55152Medium@oakserver/oak: Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers GHSA-XCXH-6CV4-Q8P8Lowhfs: HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit CVE-2025-55009High@workos-inc/authkit-remix: The AuthKit Remix Library renders sensitive auth data in HTML CVE-2025-55008High@workos-inc/authkit-react-router: The AuthKit React Router Library rendered sensitive auth data in HTML CVE-2025-54888High@fedify/fedify: @fedify/fedify has Improper Authentication and Incorrect Authorization CVE-2025-54793Mediumastro: Astros's duplicate trailing slash feature leads to an open redirection security issue CVE-2025-54885Mediumthinbus-srp: The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended CVE-2025-54798Lowtmp: tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter CVE-2025-54073Highmcp-package-docs: mcp-package-docs vulnerable to command injection in several tools CVE-2025-54803Highjs-toml: js-toml Prototype Pollution Vulnerability CVE-2025-54795High@anthropic-ai/claude-code: Claude Code echo command allowed bypass of user approval prompt for command execution CVE-2025-54794High@anthropic-ai/claude-code: Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access CVE-2025-54387Mediumipx: IPX Allows Path Traversal via Prefix Matching Bypass CVE-2025-54782Critical@nestjs/devtools-integration: @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers CVE-2025-34146High@nyariv/sandboxjs: @nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE CVE-2025-54586High@finos/git-proxy: GitProxy Hidden Commits Injection CVE-2025-54585High@finos/git-proxy: GitProxy New Branch Approval Exploit CVE-2025-54584High@finos/git-proxy: GitProxy Backfile Parsing Exploit CVE-2025-54583High@finos/git-proxy: GitProxy Approval Bypass When Pushing Multiple Branches CVE-2025-8129Lowkoa: Koa Open Redirect via Referrer Header (User-Controlled)CVE-2025-54419Critical@node-saml/node-saml: Node-SAML SAML Signature Verification Vulnerability CVE-2025-54590Mediumwebfinger.js: webfinger.js Blind SSRF Vulnerability CVE-2025-8101Highlinkifyjs: Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)CVE-2025-54378High@haxtheweb/haxcms-nodejs: HAX CMS API Lacks Authorization Checks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.