npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-101894Critical@xhmikosr/decompress: @xhmikosr/decompress: Path traversal via symlink chainCVE-2026-101912Mediumip-address: ip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an…CVE-2026-101911Mediumip-address: ip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or…CVE-2026-17495Mediummoment: moment vulnerable to Path Traversal via crafted non-string locale nameCVE-2026-102277Mediumbrace-expansion: brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of serviceCVE-2026-102278Highbrace-expansion: brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionCVE-2026-102276Highbrace-expansion: brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionCVE-2026-102599Highengine.io: Socket.IO: Engine.IO Protocol Revision Mismatch DoSGHSA-G57G-F23G-4646Mediumnodemailer: Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsingGHSA-V53P-9FQP-M79JHighnodemailer: Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of serviceGHSA-P634-W6R4-RJP2Mediumadm-zip: adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different contentGHSA-C6FG-446Q-CG94Mediumadm-zip: adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() pathGHSA-8238-W5PM-2374Highadm-zip: adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)GHSA-RCW4-F5RP-G42VHighadm-zip: adm-zip: Decompression-bomb protection (fix for CVE-2026-39244) can be bypassed by declaring uncompressed size as 0CVE-2026-102282Highadm-zip: adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationGHSA-8VVX-RFF5-P5RQMediumnodemailer: Nodemailer: Nested structured recipient arrays bypass the parser depth limit and cause stack exhaustion DoSCVE-2026-18149Mediumundici: undici vulnerable to Denial of Service via orphaned RetryHandler response bodyCVE-2026-18540Lowundici: undici vulnerable to downstream response splitting via retry interceptorCVE-2026-19534Highundici: undici vulnerable to Denial of Service via unrequested WebSocket subprotocolCVE-2026-84890Mediumundici: undici vulnerable to Denial of Service via unbounded decompression of compressed responsesCVE-2026-84933Mediumundici: undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesCVE-2026-84947Lowundici: undici vulnerable to response truncation via oversized chunked responses in the dump interceptorCVE-2026-84961Highundici: undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolCVE-2026-85008Lowundici: undici vulnerable to caching and replay of unsafe HTTP method responsesCVE-2026-85152Highundici: undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo