npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-4MFG-R38W-W8FGHighmcp-sanitizer: mcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6 GHSA-7W82-6F9J-V9JPHighmcp-sanitizer: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths CVE-2026-116693Highdd-trace: dd-trace: ReDOS in URL query string obfuscation CVE-2026-116675Hightinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization CVE-2026-116687Lowckeditor5: CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-116688Highckeditor5: CKEditor: Cross-site scripting (XSS) in the engine package CVE-2026-109829Highundici: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects CVE-2026-109383Highundici: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent CVE-2026-87018Highundici: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation CVE-2026-109932Mediumundici: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering CVE-2026-87029Mediumundici: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor GHSA-F897-62HF-6GXQHigh@modelcontextprotocol/sdk: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length CVE-2026-110816Mediumqs: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)CVE-2026-109855Highundici: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake GHSA-44JH-23M7-HPCFLow@better-auth/drizzle-adapter: @better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL GHSA-R4XP-PRCW-77QFHighbetter-auth: better-auth: OAuth Proxy lets an attacker sign in as another user CVE-2026-114607Criticalbetter-auth: better-auth: OAuth state can be used as a Magic Link to sign in as another user GHSA-4FFR-JQ9G-5FFXMediumnodemailer: Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service GHSA-G73G-HQQH-JR95Mediumnodemailer: Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped GHSA-4G23-2XM8-66GCMediumnodemailer: Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service GHSA-Q84F-53JG-9PPMHighbetter-auth: better-auth: Device login approval does not show the requesting client or permissions CVE-2026-94545Mediumsatori: Satori-generated SVG has improper escaping CVE-2026-103288Mediumghost: Ghost: Authorization Bypass in Comment Like Feature CVE-2026-46350Lowdcmjs: dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS CVE-2026-109461High@azure/msal-node: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.