npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-13760Highaws-cdk-lib: aws-cdk-lib: OS Command Injection in NodejsFunction Docker BundlingCVE-2026-13676Highfast-uri: fast-uri vulnerable to host confusion via failed IDN canonicalizationCVE-2026-59880Highimmutable: Immutable: Hash-collision algorithmic complexity denial of service in Immutable.Map/SetCVE-2026-59879Highimmutable: Immutable.js `List` 32-bit trie overflow → unrecoverable DoSCVE-2026-59896Mediumhono: hono/jsx does not isolate context per request, leading to cross-request data disclosureCVE-2026-59895Mediumhono: Hono: Server-Side XSS via JSX Escaping Bypass in cx() UtilityCVE-2026-59897Mediumhono: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplicationGHSA-FRVP-7C67-39W9Medium@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)CVE-2026-73423Mediumastro: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misorderedCVE-2026-73424Medium@astrojs/vercel: Astro: Unauthenticated path override in the @astrojs/vercel ISR functionCVE-2026-73425Low@astrojs/netlify: @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escapedCVE-2026-12590Lowbody-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementCVE-2026-59730Low@astrojs/node: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectCVE-2026-59729Mediumastro: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)CVE-2026-59728Medium@astrojs/rss: @astrojs/rss: XML Injection via Unescaped RSS Feed FieldsCVE-2026-59727Lowastro: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsCVE-2026-67320Highaxios: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloningCVE-2026-67321Mediumaxios: Axios form serializer maxDepth bypass via {} metatokenCVE-2026-67319Mediumaxios: Axios: Nested axios option objects can consume polluted prototype valuesCVE-2026-67318Mediumaxios: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`CVE-2026-67317Mediumaxios: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`CVE-2026-67316Mediumaxios: Axios: Prototype pollution gadgets can alter axios request constructionCVE-2026-67315Mediumaxios: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axiosCVE-2026-59876Mediumprotobufjs: protobufjs: Text Format string map parsing can mutate returned map object prototypeCVE-2026-59877Mediumprotobufjs: protobufjs: Denial of Service via infinite loop in .proto option parsing

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo