npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-118258Lowi18next-http-backend: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringCVE-2026-116795Highre2js: RE2JS: Quadratic-time denial of service in re2js lookbehind matchingCVE-2026-115730Lowi18next-http-backend: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a /…CVE-2026-118660Highhappy-dom: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLCVE-2026-118256Lowvue-i18n: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a listCVE-2026-118257Highvue-i18n: Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messagesCVE-2026-118661Mediumhappy-dom: Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesCVE-2026-118665High@graphql-tools/executor-legacy-ws: GraphQL Tools: Per-request connection parameters persist into later users' WebSocket authenticationsCVE-2026-118666Medium@graphql-tools/executor-legacy-ws: GraphQL Tools: Shared legacy executor routes one subscription's results to a different callerCVE-2026-118663Medium@hono/node-server: @hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static pathsCVE-2026-118255High@highcharts/dashboards: Highcharts Grid: `javascript:` URL in credits.href runs script on clickCVE-2026-118254High@highcharts/grid-lite: Highcharts Grid parses pagination language options as HTMLCVE-2026-118253High@highcharts/dashboards: Highcharts Dashboards parses fullscreen labels as HTMLCVE-2026-118252High@highcharts/dashboards: Highcharts Dashboards parses sidebar component labels as HTMLCVE-2026-118251Highhighcharts: Highcharts: `javascript:` URL in credits.href runs script on clickCVE-2026-118250Highhighcharts: Highcharts: dotted series.keys paths write to Object.prototypeCVE-2026-118249Highhighcharts: Highcharts: series column construction writes to Object.prototypeCVE-2026-118246Highhighcharts: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesCVE-2026-116797High@highcharts/grid-pro: Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`CVE-2026-118242High@highcharts/grid-lite: Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`CVE-2026-118245High@highcharts/dashboards: Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespaceCVE-2026-118247Medium@highcharts/dashboards: Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.CVE-2026-118243Medium@highcharts/dashboards: Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`CVE-2026-118244Highhighcharts: Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printingCVE-2026-116796Highhighcharts: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo