npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-102984High@astrojs/node: Astro: Malformed port in the Host header can crash the Node adapterCVE-2026-101896High@angular/router: Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix ParametersCVE-2026-97711Lowserialize-javascript: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodiesGHSA-P98J-92PF-MC4PLowdompurify: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSSCVE-2026-101916High@grpc/grpc-js: @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizedCVE-2026-101915Low@grpc/grpc-js: @grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messagesCVE-2026-101904Mediumaxios: Axios: Header Injection via Inherited headers After Minimal InterceptorCVE-2026-101900Mediumaxios: Axios: Fetch Adapter Header Injection via Inherited FormData getHeadersCVE-2026-101905Highaxios: Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionCVE-2026-101899Mediumaxios: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP rangesCVE-2026-101907Highaxios: Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFCVE-2026-101908Mediumaxios: Axios: Prototype pollution gadget in fetch adapter can alter outbound requestsCVE-2026-101902Mediumaxios: Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP MethodCVE-2026-101903Highaxios: Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)CVE-2026-101906Highaxios: Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect LocationCVE-2026-101909Highaxios: Axios: Prototype Pollution Gadget in axios toFormData OptionsCVE-2026-101898Highaxios: Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsCVE-2026-101901Highaxios: Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session InitializationGHSA-VCVR-R3JV-PC5JCriticalnext: Next.js: Remote Code Execution in next/og ImageResponseGHSA-96H4-VGXJ-GVM2Medium@nestjs/microservices: Nest: Unbounded memory growth in the NestJS TCP microservice transportGHSA-9C5C-9QCX-Q35QHigh@nestjs/platform-fastify: @nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targetsCVE-2026-90776Highnodemailer: Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)CVE-2026-102281High@nestjs/microservices: Nest: Remote process termination via a deeply nested microservice message patternCVE-2026-86472Mediumfast-uri: fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86818Mediumfast-uri: fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo