npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-63116High@deepstream/server: deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writesCVE-2026-62985Highrequest-filtering-agent: request-filtering-agent: Synchronous throw from createConnection() for literal private-IP hosts bypasses req.on('error'), crashing the…CVE-2026-56682Medium9router: 9Router has a Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip HeaderCVE-2026-56681High9router: 9Router has an Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip HeaderCVE-2026-61612Medium@aborruso/ckan-mcp-server: @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509CVE-2026-58272Medium@sync-in/server: Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack…CVE-2026-58270Medium@sync-in/server: Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`CVE-2026-58269High@sync-in/server: Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`CVE-2026-58271Medium@sync-in/server: @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`CVE-2026-61647High@roomi-fields/notebooklm-mcp: @roomi-fields/notebooklm-mcp has a path traversal in vault.batch tool that allows arbitrary file write outside intended vault directoryCVE-2026-93749Highsource-map-js: source-map-js allows event-loop denial of service through indexed source-map section offsetsCVE-2026-93753Lowdeepmerge: deepmerge mergeObject() allows prototype poisoning of returned objectsCVE-2026-91127High@file-viewer/doc: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererCVE-2026-77301Highadm-zip: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)CVE-2026-84992Mediummd-editor-v3: md-editor-v3: XSS via fenced-code language rendering bypassCVE-2026-77615Highorg.opencastproject:opencast-engage-paella-player-7: Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue textCVE-2026-88976Medium@platejs/core: @platejs/core HTML deserialization can trigger browser behavior during parsingCVE-2026-81176Mediumdevalue: Svelte devalue: DoS via malformed inputCVE-2026-86039High@libp2p/peer-store: libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addressesCVE-2026-86038High@libp2p/gossipsub: libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer IDCVE-2026-85715Highexifreader: ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory ExhaustionCVE-2026-63506High@tinacms/auth: Tina: [Broken Access Control] letting any TinaCloud user authorize against any self-hosted siteCVE-2026-63225Medium@redocly/cli: Redocly CLI: Path traversal when using `split` commandCVE-2026-77360Medium@orpc/server: oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS BypassCVE-2026-71538High@cyclonedx/cyclonedx-npm: @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo