npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-30359Mediumwebpack-dev-server: webpack-dev-server users' source code may be stolen when they access a malicious web site CVE-2025-2336Mediumangular-sanitize: AngularJS Incomplete Filtering of Special Elements vulnerability CVE-2025-49223Criticalbillboard.js: billboard.js allows prototype pollution via the function generate CVE-2025-48387Hightar-fs: tar-fs can extract outside the specified dir with a specific tarball CVE-2025-5273Mediummcp-markdownify-server: Markdownify MCP Server allows attackers to read arbitrary files CVE-2025-5276Mediummcp-markdownify-server: Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function CVE-2025-48068Lownext: Information exposure in Next.js dev server due to lack of origin verification CVE-2025-48370Low@supabase/auth-js: auth-js Vulnerable to Insecure Path Routing from Malformed User Input CVE-2024-52588Medium@strapi/admin: Strapi allows Server-Side Request Forgery in Webhook function CVE-2025-48054Mediumradashi: radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')CVE-2018-25110Mediummarked: Marked allows Regular Expression Denial of Service (ReDoS) attacks CVE-2025-47949Criticalsamlify: samlify SAML Signature Wrapping attack CVE-2025-47944Highmulter: Multer vulnerable to Denial of Service from maliciously crafted requests CVE-2025-47935Highmulter: Multer vulnerable to Denial of Service via memory leaks from unclosed streams CVE-2025-47934Highopenpgp: OpenPGP.js's message signature verification can be spoofed CVE-2025-47948Mediumcocotais-bot: Cocotais Bot has builtin .echo command injection CVE-2025-4759Mediumlockfile-lint-api: lockfile-lint-api Vulnerable to Incorrect Behavior Order CVE-2025-4727Mediummeteor: Meteor Affected By Inefficient Regular Expression Complexity CVE-2025-1647Mediumbootstrap: Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components CVE-2025-47279Lowundici: undici Denial of Service attack via bad certificate data CVE-2025-32421Lownext: Next.js Race Condition to Cache Poisoning CVE-2025-47204Mediumbootstrap-multiselect: Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data CVE-2025-47828Medium@lumieducation/h5p-server: @lumieducation/h5p-server Fails to Sanitize Plain Text Strings CVE-2025-47269Highcode-server: code-server's session cookie can be extracted by having user visit specially crafted proxy URL CVE-2025-46812Lowtrix: Trix vulnerable to Cross-site Scripting on copy & paste

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.