npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-104850High@modelcontextprotocol/sdk: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverCVE-2026-105800Lowi18next-http-backend: i18next-http-backend incomplete URL validation permits SSRFCVE-2026-105799Low@langchain/redis: LangChain: RediSearch Filter Injection via Unescaped Tag/Text ValuesGHSA-WQ5F-XC86-PV6WHighsharp: sharp : Vulnerability in librsvg dependency CVE-2026-96889CVE-2026-102422Criticalshell-quote: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` tokenCVE-2026-102414Mediumpbkdf2: pbkdf2 rehashes long passwords on every iteration, enabling denial of serviceCVE-2026-102829Critical@simple-git/argv-parser: simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionCVE-2026-102828Criticalsimple-git: simple-git unsafe-operation guard does not block trailer command configurationCVE-2026-102826Highsimple-git: simple-git allows command execution through unblocked Git configuration includesCVE-2026-102827Highsimple-git: simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of…CVE-2026-102600High@socket.io/cluster-engine: Socket.IO: Prototype Pollution via Unsafe Client Session LookupGHSA-6688-9RHM-GJV2Lowdompurify: DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup — pure HTML reparse executesGHSA-R4XH-JQRQ-34V2Mediumsmol-toml: smol-toml: Quadratic-time parse() from parseKey rescanning to end of document on each key lineCVE-2026-103923Lowkatex: KaTeX: Existing prototype pollution can bypass trust restrictionsCVE-2026-104846Criticalseroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)CVE-2026-104845Highseroval: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationCVE-2026-90711Criticalproxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetCVE-2026-104859High@nx/docker: @nx/docker: OS command injection in the @nx/docker release pipelineGHSA-W2VW-W76X-QR89Highnx: Nx: OS command injection via git revisions and remote refsCVE-2026-104854Highnx: Nx daemon and plugin worker sockets are accessible to other local usersCVE-2026-104853Mediumnx: Nx: Path traversal in nx migrate package-migrations extractionCVE-2026-87776Highcompression: compression vulnerable to Denial of Service via memory leak on premature response closeGHSA-G7FW-3GJP-G5HFMedium@openclaw/msteams: OpenClaw: Channel read actions could skip target allowlistsCVE-2026-100721Criticalvm2: vm2: NodeVM custom resolution bypasses external path boundariesCVE-2026-100722Highvm2: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo