npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-3191Lowreact-draft-wysiwyg: React Draft Wysiwyg Cross-Site Scripting (XSS) via the Embedded Button CVE-2025-31477Criticaltauri-plugin-shell: Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`CVE-2025-30218Lownext: Next.js may leak x-middleware-subrequest-id to external hosts CVE-2025-71319Highimage-size: image-size Denial of Service via Infinite Loop during Image Processing CVE-2025-31137High@react-router/express: Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers CVE-2024-38988High@alizeait/unflatto: @alizeait/unflatto Prototype Pollution GHSA-QQ4X-C6H6-RFXHMediumaws-cdk-lib: aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct CVE-2025-31128Mediumgifplayer: gifplayer XSS vulnerability CVE-2025-31125Mediumvite: Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query CVE-2025-26042Mediumuptime-kuma: Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking CVE-2024-57083Highredoc: Redoc Prototype Pollution via `Module.mergeObjects` Component CVE-2024-38985Highdepath: depath and cool-path vulnerable to Prototype Pollution via `set()` Method CVE-2024-12905Hightar-fs: tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File CVE-2025-27793Mediumvega: Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]CVE-2025-26619Mediumvega: Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter CVE-2025-30353Highdirectus: Directus's webhook trigger flows can leak sensitive data CVE-2025-30352Mediumdirectus: Directus `search` query parameter allows enumeration of non permitted fields CVE-2025-30351Lowdirectus: Suspended Directus user can continue to use session token to access API CVE-2025-30350Medium@directus/storage-driver-s3: Directus's S3 assets become unavailable after a burst of HEAD requests CVE-2025-30225Medium@directus/storage-driver-s3: Directus's S3 assets become unavailable after a burst of malformed transformations CVE-2025-30222Lowshescape: Shescape has potential environment variable exposure on Windows with CMD CVE-2025-2792Low@mozilla/readability: @mozilla/readability Denial of Service through Regex CVE-2025-30208Mediumvite: Vite bypasses server.fs.deny when using ?raw??GHSA-5PQ3-H73F-66HRLowaws-cdk-lib: AWS CDK CodePipeline: trusted entities are too broad CVE-2025-2699MediumContentTools: GetmeUK ContentTools Cross-Site Scripting (XSS)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.