npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-100723Mediumvm2: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundaryCVE-2026-103921High@graphql-tools/executor-legacy-ws: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket ExecutorCVE-2026-104852High@graphql-tools/utils: GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`CVE-2026-86597Mediumsnowflake-sdk: Snowflake drivers writes sensitive information to logsCVE-2026-104844Mediumpostcss-selector-parser: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustionCVE-2026-104871Medium@angular/ssr: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on WindowsCVE-2026-103922Critical@capacitor/android: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy pathCVE-2026-104872Medium@opentelemetry/instrumentation-cassandra-driver: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeGHSA-JGGR-W7FW-PC2JMediumfast-copy: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested valuesGHSA-G2V6-RQMX-R4W6High@vue/server-renderer: @vue/server-renderer: XSS via missing CR in attribute-name blacklistCVE-2026-104848Criticaltinypool: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code ExecutionCVE-2026-104849Criticaltinypool: Tinypool: Prototype Pollution Gadget to RCE in run() optionsCVE-2026-104182Mediumstream-json: stream-json: JSONC parser and verifier re-scan the whole accumulated comment on every input chunkCVE-2026-104183Mediumstream-json: stream-json has a prototype pollution issue: Assembler writes this.current[this.key] on plain objectsCVE-2026-92959Highvm2: vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVMCVE-2026-92955Criticalvm2: vm2: Sandbox Escape (NodeVM)CVE-2026-92954Criticalvm2: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host processCVE-2026-92953Criticalvm2: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fixCVE-2026-92934Criticalvm2: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuitCVE-2026-92933Mediumvm2: vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stackCVE-2026-104847Highprosemirror-view: ProseMirror has a XSS vulnerability in prosemirror-view's paste handlingCVE-2026-92936Mediumvm2: vm2 leaks absolute host filesystem paths to sandbox code via error stack formattingCVE-2026-92942Highvm2: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)CVE-2026-92946Criticalvm2: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCECVE-2026-92947Criticalvm2: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo