npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-52573Mediumios-simulator-mcp: iOS Simulator MCP Command Injection allowed via exec API CVE-2025-6624Lowsnyk: Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode CVE-2025-6547Criticalpbkdf2: pbkdf2 silently disregards Uint8Array input, returning static keys CVE-2025-6545Criticalpbkdf2: pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos CVE-2025-52882High@anthropic-ai/claude-code: Claude Code Improper Authorization via websocket connections from arbitrary origins GHSA-8G98-M4J9-QWW5Criticaltaylored: Taylored webhook validation vulnerabilities CVE-2025-50183Medium@openlist-frontend/openlist-frontend: OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer CVE-2025-6087High@opennextjs/cloudflare: OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint CVE-2025-49596Critical@modelcontextprotocol/inspector: MCP Inspector proxy server lacks authentication between the Inspector client and proxy CVE-2025-29744Mediumpg-promise: pg-promise SQL Injection vulnerability CVE-2025-36852Critical@nx/azure-cache: @nx/azure-cache Vulnerable to Build Cache Poisoning via Untrusted Pull Requests CVE-2024-57190Higherxes: Erxes Incorrect Access Control vulnerability CVE-2024-57189Mediumerxes: Erxes Path Traversal vulnerability CVE-2024-57186Higherxes: Erxes Path Traversal vulnerability CVE-2025-5897Medium@vue/cli-plugin-pwa: @vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability CVE-2025-5896Mediumtaro-css-to-react-native: taro-css-to-react-native Regular Expression Denial of Service vulnerability CVE-2025-5891Lowpm2: pm2 Regular Expression Denial of Service vulnerability CVE-2025-5889Lowbrace-expansion: brace-expansion Regular Expression Denial of Service vulnerability CVE-2025-49141High@haxtheweb/haxcms-nodejs: HaxCMS-PHP Command Injection Vulnerability CVE-2025-49139Medium@haxtheweb/haxcms-nodejs: @haxtheweb/haxcms-nodejs Iframe Phishing vulnerability CVE-2025-45001Highreact-native-keys: react-native-keys insecurely stores encryption cipher and Base64 chunks CVE-2025-48997Highmulter: Multer vulnerable to Denial of Service via unhandled exception CVE-2025-48996Medium@haxtheweb/open-apis: Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint CVE-2025-48947High@auth0/nextjs-auth0: NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookies CVE-2025-30360Mediumwebpack-dev-server: webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo