npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-71476Highnx: Nx: Zip-Slip in the self-hosted remote cache CVE-2026-71439Mediummermaid: Mermaid radar diagrams are vulnerable to DoS CVE-2026-71438Lowmermaid: Mermaid configuration APIs allow prototype pollution CVE-2026-50159Mediummermaid: Mermaid allows CSS injection applying to sibling elements of the diagram CVE-2026-71437Mediummermaid: Mermaid Architecture diagrams are vulnerable to prototype pollution CVE-2026-71436Mediummermaid: Mermaid XY Charts are vulnerable to an infinite loop DoS CVE-2026-71321Highnuxt: Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation CVE-2026-71320Highnuxt: Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props CVE-2026-71319Critical@nuxt/devtools: Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host CVE-2026-71318Mediumnuxt: Nuxt: Unauthorized Component Instantiation via Server Island Props CVE-2026-71316Highnuxt: Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients CVE-2026-71315Highnuxt: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)CVE-2026-71314Highnuxt: Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering CVE-2026-70612Mediumelectron: Electron: Sandboxed iframes can launch external protocol handlers CVE-2026-70611Mediumelectron: Electron: DevTools embedder handler executes arbitrary files via shell open CVE-2026-70610Mediumelectron: Electron: contextBridge object copy honors prototype setters CVE-2026-70609Mediumelectron: Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter CVE-2026-70608Highelectron: Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path CVE-2026-70607Mediumelectron: Electron: window.open features string controls some window options considered privileged CVE-2026-70606Mediumelectron: Electron: ProtocolResponse.url reuses the default session cache instead of the registering session CVE-2026-70605Mediumelectron: Electron: HTTP redirect followed into local file loader CVE-2026-70604Highelectron: Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads CVE-2026-70602Mediumelectron: Electron: Extension tab APIs operate across session boundaries CVE-2026-70603Mediumelectron: Electron: shell.openPath path validation bypass via embedded null byte CVE-2026-70601Highelectron: Electron: Context isolation bypass via Function.prototype.bind hijack

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo