npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-85014Mediumundici: undici vulnerable to Denial of Service via WebSocketStream unclean closeCVE-2026-92599Highjoi: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`CVE-2026-102672Mediumelectron: Electron: Local race condition in Squirrel.Mac update installation on macOSCVE-2026-102673Highelectron: Electron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTabCVE-2026-102674Highelectron: Electron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictionsCVE-2026-102675Highelectron: Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledCVE-2026-102676Highelectron: Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionsCVE-2026-102677Highelectron: Electron: Sandboxed preload code cache can be poisoned by a compromised rendererGHSA-253C-MCHW-3W2RMediummarkdown-it: markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of secondsGHSA-R3PH-W7GJ-G6XMMediumjs-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesCVE-2026-76844Highwebpack-dev-middleware: webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPathGHSA-6VJ9-MWQ6-2F5VMediumnodemailer: Nodemailer: Process-global DNS cache reuses TLS `servername` across transports, enabling cross-tenant SMTP credential disclosureCVE-2026-85024Mediumundici: undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompressionCVE-2026-88932Mediummulter: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsCVE-2026-87859Mediummorgan: morgan vulnerable to Log Injection via unescaped double quote in quoted log fieldsCVE-2026-101895High@angular/platform-server: Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPECVE-2026-84292Highfast-uri: fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84394Highfast-uri: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-101913Mediumip-address: ip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hostsCVE-2026-101910Mediumip-address: ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypassCVE-2026-88058High@angular/platform-server: Angular SSR: XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content ElementsCVE-2026-101914Medium@grpc/grpc-js-xds: @grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matchesCVE-2026-61834Mediumscim-patch: scim-patch: Mutation of Inherited Built-in Method ObjectsGHSA-456V-XQ2P-R4CJHighcode-ollama: code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)CVE-2026-86439Highknowns: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo