npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54729Highdssrf: dssrf: any users using 1.1.1.1 DNS is impacted by SSRFCVE-2026-67550Mediumre2: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process…CVE-2026-68499Mediumre2: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth…CVE-2026-54753Mediumnx: `nx graph` dev server permissive CORS policyGHSA-P7W7-4929-VPJ5High@dynatrace-oss/dynatrace-mcp-server: `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool InvocationGHSA-XRMJ-5G4G-8987Medium@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server has a workflow template injection via create_workflow_for_notificationGHSA-PQH8-P93P-2RX7Medium@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server has a DQL injection via parameters not documented as DQLCVE-2025-4318Critical@aws-amplify/codegen-ui-react: AWS Amplify Studio UI Component Properties Has an Input Validation IssueCVE-2026-54722Highdssrf: dssrf has an SSRF bypass with remove_at_symbol_in_stringCVE-2026-54705Mediummathlive: mathlive's Lack of Escaping of HTML allows for XSSCVE-2026-11393High@aws/agentcore: AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote EscapingGHSA-PC2W-4MQ8-32QWLow@dynatrace-oss/dynatrace-mcp-server: @dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human-approval gateCVE-2026-67214Highnanoid: nanoid: non-secure generators can loop indefinitely with negative sizeCVE-2026-67213Highnanoid: nanoid: custom generators can loop indefinitely when size is zeroCVE-2026-54666Highswagger-typescript-api: swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodiesCVE-2026-54664Highswagger-typescript-api: swagger-typescript-api vulnerable to code injection via unescaped enum string valuesCVE-2026-54661Highswagger-typescript-api: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client templateCVE-2026-54663Mediumswagger-typescript-api: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`CVE-2026-54662Highswagger-typescript-api: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templateCVE-2026-54660Highswagger-typescript-api: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`CVE-2026-54639Highstyle-dictionary: Style Dictionary - Prototype Pollution in convertTokenData utility functionCVE-2026-54658Critical@hypequery/clickhouse: @hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL executionCVE-2026-52888Medium@nocobase/plugin-collection-sql: NocoBase: Sensitive Data Exposure via SQL Blacklist BypassCVE-2026-54609Highcom.quietterminal:qti-neon: QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingGHSA-VG6V-J97M-H5XQMedium@novu/application-generic: @novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo