npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-32442Highfastify: Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass CVE-2025-32791Medium@backstage/plugin-permission-backend: Permission policy information leakage in Backstage permission system GHSA-QC59-CXJ2-C2W4Lowaws-cdk-lib: aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role CVE-2025-3573Mediumjquery-validation: jquery-validation vulnerable to Cross-site Scripting CVE-2025-32996Mediumhttp-proxy-middleware: http-proxy-middleware can call writeBody twice because "else if" is not used CVE-2025-32997Mediumhttp-proxy-middleware: http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed CVE-2025-32388Medium@sveltejs/kit: @sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params CVE-2024-47822Medium@directus/api: Directus inserts access token from query string into logs CVE-2025-32395Mediumvite: Vite has an `server.fs.deny` bypass with an invalid `request-target`CVE-2025-32379Mediumkoa: Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function CVE-2025-32020Highcrud-query-parser: crud-query-parser SQL Injection vulnerability CVE-2025-29189Highflowise-components: Flowise Vulnerable to SQL Injection via `tableName` Parameter CVE-2025-32029Medium@apeleghq/asn1-der: ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representation CVE-2025-32014Mediumestree-util-value-to-estree: estree-util-value-to-estree allows prototype pollution in generated ESTree CVE-2025-32031High@apollo/gateway: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass CVE-2025-32030High@apollo/gateway: Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion CVE-2025-71332Highflowise: FlowiseDB vulnerable to SQL Injection by authenticated users CVE-2025-28269Highjs-object-utilities: js-object-utilities Vulnerable to Prototype Pollution CVE-2025-31476Mediumtarteaucitronjs: tarteaucitron.js allows url scheme injection via unfiltered inputs CVE-2025-31475Mediumtarteaucitronjs: tarteaucitron.js allows prototype pollution via custom text injection CVE-2025-31138Mediumtarteaucitronjs: tarteaucitron.js allows UI manipulation via unrestricted CSS injection CVE-2025-31486Mediumvite: Vite allows server.fs.deny to be bypassed with .svg or relative paths CVE-2025-31119Highgenerator-jhipster-entity-audit: generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework CVE-2025-3197Mediumexpand-object: expand-object Vulnerable to Prototype Pollution via the expand() Function CVE-2025-3194Highbigint-buffer: bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.