npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-109869Highundici: undici vulnerable to Denial of Service via unhandled error on excessive content-encodingsCVE-2026-109924Mediumundici: undici vulnerable to Denial of Service via unbounded memory in the EventSource parserCVE-2026-109841Mediumundici: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokensCVE-2026-115897Lowserialize-javascript: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyCVE-2026-113872Highmulter: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownCVE-2026-115895Highhappy-dom: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code executionGHSA-H4FR-CMH5-QR62Lowfallow: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project rootCVE-2026-115569Lowfallow: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project rootGHSA-F2HQ-32VH-53CCHighpostal-mime: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded wordsGHSA-8C8M-P3M8-CJG8Mediumnodemailer: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipientGHSA-M943-M63M-W62WMediumnodemailer: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipientGHSA-85X2-Q946-CP5HMediumnodemailer: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not nameCVE-2026-110306Mediumfast-uri: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingCVE-2026-110095Lowfast-uri: fast-uri vulnerable to improper path equivalence in relative reference normalizationCVE-2026-110180Mediumfast-uri: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationCVE-2026-110725Lowfast-uri: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesCVE-2026-114060Low@sveltejs/kit: SvelteKit: URL redirection to untrusted site via enhanced form submissionGHSA-2RQM-H6HV-G79VMediumodf-kit: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute valuesCVE-2026-115570Highelectron: Electron: Mitigation for compromised eMudhra intermediate certificatesCVE-2026-111181Highbody-parser: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyCVE-2026-115419Highstrands-agents: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerCVE-2026-114061Low@sveltejs/kit: SvelteKit : XSS via untrusted cache-control header in prerendered pageCVE-2026-115478Highobsidian-tc: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changesCVE-2026-77363Criticalobsidian-tc: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopbackCVE-2026-77362Mediumobsidian-tc: obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo