npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-86080Mediumn8n: n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-OpenCVE-2026-86079Mediumn8n: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded IdentifiersCVE-2026-86078Mediumn8n: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of ServiceCVE-2026-86994Mediumn8n: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId FilterCVE-2026-86083Highn8n: n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code ExecutionCVE-2026-86077Mediumn8n: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocketCVE-2026-88060High@angular/platform-server: Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content ElementsCVE-2026-88056High@angular/platform-server: Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSRCVE-2026-88059Medium@angular/common: Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`CVE-2026-88057Medium@angular/core: Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compilerCVE-2026-86082Highn8n: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model NodeCVE-2026-86081Highn8n: n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone PathCVE-2026-86075Highn8n: n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration EndpointCVE-2026-86076Highn8n: n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code ExecutionGHSA-X7M8-JRM8-HPVXHigh@eigenpal/docx-editor-core: @eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family nameCVE-2026-59179High@openhop/server: @openhop/server: Path Traversal in Flow ID File OperationsCVE-2026-59176Highfunctype-mcp-server: functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic ImportCVE-2026-59160High@yeger/turbo-graph: @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/runCVE-2026-59158Highnuxt-ollama: Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser ClientsCVE-2026-85730Highsmol-toml: smol-toml: Denial of Service via malformed TOML documentsCVE-2026-86996Mediumn8n: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller PolicyGHSA-WMMP-3585-3RMPMediumnodemailer: Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domainGHSA-2X7J-588G-CCC2Highnodemailer: Nodemailer: Quadratic (O(n²)) time complexity in addressparser allows remote denial of service via a crafted address listGHSA-CC9R-2J5M-2M83Mediumnodemailer: Nodemailer: Recipient-domain validation bypass via RFC 5322 comment mis-parsing leads to email delivery to an attacker-controlled domainGHSA-2Q42-4Q24-7RGVHigh@typespec/openapi3: OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo