npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-14631Mediumwebpack-dev-server: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVE-2026-14620Mediumwebpack-dev-server: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints CVE-2026-59731Highastro: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVE-2026-59871Mediumtar: node-tar: Process crash via PAX numeric path type confusion CVE-2026-59873Criticaltar: node-tar: Decompression/parse DoS via unlimited input CVE-2026-59874Hightar: node-tar: Negative tar entry size causes infinite loop in archive replace CVE-2026-59875Mediumtar: node-tar: Uncaught Exception DoS via NUL byte in PAX path/linkpath records CVE-2026-59725Highengine.io: Socket.IO: Engine.IO Polling Transport Connection Exhaustion CVE-2026-13311Highshell-quote: shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)CVE-2026-61836Highdirectus: Directus: Authorization-dependent response served from unsegmented cache key CVE-2026-61835Highdirectus: Directus: SSRF Protection Bypass via 0.0.0.0 in File Import CVE-2026-59868Mediumjs-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption in js-yaml CVE-2026-59869Highjs-yaml: js-yaml: YAML merge-key chains can force quadratic CPU consumption CVE-2026-59870Mediumjs-yaml: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA CVE-2026-73422Mediumastro: Astro: Reflected XSS via unescaped View Transition animation properties CVE-2026-53515High@better-auth/sso: @better-auth/sso: SSO provider may allow registration for any org member without a checking their role CVE-2026-13149Highbrace-expansion: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups CVE-2026-67313Mediumaxios: Axios: Excessive recursion in formDataToJSON can cause denial of service CVE-2026-67314Mediumaxios: Axios: Prototype pollution auth subfields can inject Basic auth CVE-2026-67312Mediumaxios: Axios: Deep formToJSON Key Recursion Can Cause Denial of Service CVE-2026-55177High@tak-ps/cloudtak: CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard CVE-2026-53496Mediumexifreader: ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes CVE-2026-53597High@prompty/core: Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader CVE-2026-53598Highprompty: Prompty: Arbitrary file read via file reference expansion CVE-2026-54561Mediummcp-memory-keeper: mcp-memory-keeper: Arbitrary local file read in context_import via unvalidated filePath

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.