npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-92957Criticalvm2: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_processCVE-2026-92949Mediumvm2: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptorCVE-2026-92935Criticalvm2: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCECVE-2026-92937Criticalvm2: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirectionCVE-2026-92938Criticalvm2: vm2 allows a sandboxed plugin to execute native code through `node:sqlite`CVE-2026-92939Criticalvm2: vm2 crypto builtin loads attacker native code through setEngineCVE-2026-92944Criticalvm2: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protectorCVE-2026-92941Criticalvm2: vm2 NodeVM can replace the host process TLS trust storeCVE-2026-92945Mediumvm2: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlistedCVE-2026-92708Highdevalue: devalue: `stringify`/`uneval` serialize shared memoryGHSA-HX4R-W6WJ-J8FGMediumdevalue: devalue: Residual sparse-array CPU amplification in unevalGHSA-MCM9-63F2-9J32Highdevalue: devalue: Repeated primitive strings cause quadratic expansion in unevalGHSA-WF3X-273G-MVXVLowdevalue: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluatedGHSA-R9W8-H9R3-54W4Highdevalue: devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validationGHSA-X5RW-Q4PP-HG5GHighdevalue: devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promiseGHSA-4Q55-J62X-FR9HMediumdevalue: devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercionCVE-2026-102992Criticalpiscina: piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envCVE-2026-102990Highbasic-ftp: basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)CVE-2026-92081Mediumfastify: fastify vulnerable to Denial of Service via unhandled exception on HTTP/2 trailer responsesCVE-2026-93981Mediumhono: hono/jsx renders plain strings unescaped in boundary components, leading to XSSCVE-2026-84504Highfastify: fastify vulnerable to request body replacement via an async validation result collisionCVE-2026-76169Highfastify: fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlersCVE-2026-84469Highfastify: fastify vulnerable to request validation bypass via skipped boolean false schemasCVE-2026-84428Highfastify: fastify vulnerable to header validation bypass via incomplete schema case normalizationCVE-2026-102983Medium@astrojs/netlify: Astro: Netlify Image CDN allowlist bypass enables SSRF

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo