npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-83615High@xmldom/xmldom: xmldom: Quadratic-memory consumption CVE-2026-83614High@xmldom/xmldom: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge CVE-2026-83612High@xmldom/xmldom: xmldom: HTML raw-text closing-tag case mismatch causes output amplification CVE-2026-84368Lowjoi: joi: Prototype pollution via a `__proto__` language key in custom messages CVE-2026-85062Mediumcolord: Colord: Slow rejection of oversized malformed color strings CVE-2026-75604Criticalnext: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers CVE-2026-84367Lowjoi: joi: object().rename() with a template target can set the validated object's prototype CVE-2026-85061Criticalmaplibre-gl: MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip CVE-2026-84373Medium@vitest/mocker: Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock CVE-2026-83606High@xmldom/xmldom: xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions CVE-2026-83607High@xmldom/xmldom: xmldom: Element name injection via createElement() bypasses requireWellFormed CVE-2026-83605High@xmldom/xmldom: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed CVE-2026-82533Critical@deepseek-ai/dsh-client-connection: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API CVE-2026-69222Highliquidjs: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process CVE-2026-85063Mediumcsv-parse: node-csv: Prototype replacement still reachable via columns path CVE-2026-72925Medium@swc/html: SWC HTML minifier may allow script element breakout when minifying embedded JSON CVE-2026-76969Critical@sap/cds-mtxs: @sap/cds-mtx: Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)GHSA-7Q9C-HPX7-9CWMHigh@typespec/spector: TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop CVE-2026-75911Highdeepseek-tui: CodeWhale: Project config `allow_shell` override enables arbitrary shell command execution via cloned repository CVE-2026-75858Highdeepseek-tui: CodeWhale: rlm_eval auto-approves arbitrary Python execution, bypassing the user's approval policy (RCE)CVE-2026-75912Highdeepseek-tui: CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval CVE-2026-75856Criticaldeepseek-tui: CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning CVE-2026-75915Highdeepseek-tui: CodeWhale: js_execution leaks parent environment to model context via missing env scrub CVE-2026-75913Highdeepseek-tui: CodeWhale: Argument Injection in `git_show` Tool Allows Arbitrary File Write Without Approval CVE-2026-75857Highdeepseek-tui: CodeWhale: exec_shell_interact sends LLM-controlled input to a running shell without an approval prompt (privilege escalation)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.