npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-2691Highnossrf: nossrf Server-Side Request Forgery (SSRF)CVE-2025-2598Mediumaws-cdk: AWS CDK CLI prints AWS credentials retrieved by custom credential plugins CVE-2025-30168Mediumparse-server: Parse Server has an OAuth login vulnerability CVE-2025-29927Criticalnext: Authorization Bypass in Next.js Middleware GHSA-5CCF-884P-4JJQHighopen-webui: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability CVE-2024-12537Highopen-webui: Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2024-12534Highopen-webui: Open WebUI Uncontrolled Resource Consumption vulnerability CVE-2025-27415Highnuxt: Nuxt allows DOS via cache poisoning with payload rendering response CVE-2025-30144Mediumfast-jwt: Fast-JWT Improperly Validates iss Claims CVE-2025-29907Highjspdf: jsPDF Bypass Regular Expression Denial of Service (ReDoS)CVE-2025-1398Lowmattermost-desktop: Mattermost Desktop App allows the bypass of Transparency, Consent, and Control (TCC) via code injection CVE-2025-29771Medium@jitbit/htmlsanitizer: JS Html Sanitizer allows XSS when used with contentEditable CVE-2025-71338Criticalflowise: Flowise allows arbitrary file write to RCE CVE-2024-29409Medium@nestjs/common: nest allows a remote attacker to execute arbitrary code via the Content-Type header CVE-2025-29776Highazle: In Azle, calling `setTimer` causes infinite loop of timers CVE-2025-29775Criticalxml-crypto: xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVE-2025-29774Criticalxml-crypto: xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References GHSA-H42X-XX2Q-6V6GCriticalflowise: Flowise Pre-auth Arbitrary File Upload CVE-2025-25975Highparse-git-config: Prototype Pollution Vulnerability in parse-git-config CVE-2025-27789Medium@babel/helpers: Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups CVE-2025-59049High@mockoon/commons-server: Mockoon has a Path Traversal and LFI in the static file serving endpoint CVE-2025-25977Highcanvg: canvg Prototype Pollution vulnerability CVE-2025-27597High@intlify/message-resolver: Vue I18n Allows Prototype Pollution in `handleFlatJson`CVE-2025-27152Highaxios: axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL CVE-2025-27506Mediumnocodb: NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.