npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-77078Highmulter: multer vulnerable to Denial of Service via crafted multipart field names CVE-2026-77037Highmulter: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads CVE-2026-77063Lowmulter: multer vulnerable to file size limit bypass via async fileFilter race condition CVE-2026-82333Highmulter: multer vulnerable to Denial of Service via oversized array index in field names CVE-2026-15603Mediummorgan: morgan vulnerable to Log Forging via unescaped Unicode line separators GHSA-26W7-CXV4-GFX2Criticalastro: Astro: Remote code execution through AVIF image optimization CVE-2026-84376Mediumastro: Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base GHSA-RGJ7-G3M4-5G8CHighsharp: sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 CVE-2026-84375Highjs-yaml: js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources GHSA-J95F-988M-3J2FHigh@tiptap/core: Tiptap: Quadratic ReDoS in block and inline Markdown attribute parsing CVE-2026-84365Mediumhono: Hono: Incomplete fix for CVE-2026-39408: `toSSG()` still writes files outside the output directory CVE-2026-84364Mediumhono: Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion CVE-2026-84363Mediumhono: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials GHSA-2XP9-VWFH-VXW4Criticalnext: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used CVE-2026-84370Highsvgo: SVGO: removeScripts allows executable links through namespace and control-character bypasses CVE-2026-84369Mediumsvgo: SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements GHSA-8M3C-C648-2XJJMediumnodemailer: Nodemailer: resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess when called with the legacy signature CVE-2026-83616High@xmldom/xmldom: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83617High@xmldom/xmldom: xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVE-2026-83608High@xmldom/xmldom: xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83609High@xmldom/xmldom: xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default…CVE-2026-83618High@xmldom/xmldom: xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVE-2026-83611Medium@xmldom/xmldom: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83613High@xmldom/xmldom: xmldom: Quadratic-time attribute deduplication CVE-2026-83619High@xmldom/xmldom: xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo