npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-69198Mediumip-address: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checksCVE-2026-54272Mediumip-address: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksCVE-2026-15157Mediumundici: undici vulnerable to CRLF Injection via blob-like body 'type' propertyCVE-2026-14643Mediumundici: undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directivesCVE-2026-16729Mediumundici: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fieldsCVE-2026-16728Mediumundici: undici vulnerable to downstream response desynchronization via retry interceptorCVE-2026-13697Highundici: undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directivesCVE-2026-18446Highfast-uri: fast-uri vulnerable to host confusion via backslash authority introducerCVE-2026-69185Highsocket.io-parser: Socket.IO: Zero-attachment Memory ExhaustionCVE-2026-69153Mediumpostcss: PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetCVE-2026-69152Highbrace-expansion: brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-69151High@angular/compiler: Angular i18n: Cross-Site Scripting (XSS) via event-handler attributesCVE-2026-69149High@angular/platform-server: Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)CVE-2026-68945High@angular/common: Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State PoisoningCVE-2026-53608High@apostrophecms/seo: @apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script TagCVE-2026-53607Lowapostrophe: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host headerCVE-2026-53609Criticalapostrophe: Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypassCVE-2026-53606Mediumsanitize-html: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background…CVE-2026-52887Critical@nocobase/plugin-notification-in-app-message: NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCECVE-2026-65841Mediumjodit: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitizationCVE-2026-58263Highjodit: Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrierCVE-2026-54756Mediumjodit: Jodit has prototype pollution via Jodit.configure() / ConfigMergeCVE-2026-62324Mediumjodit: Jodit has incomplete javascript: scheme normalization in sanitizeHTMLElement href check that allows link XSSCVE-2026-54737High@phun-ky/defaults-deep: @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property MergingCVE-2026-55100Highhashi-vault-js: hashi-vault-js has a path traversal and query parameter injection

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo