npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-54299Highastro: Astro: Host header SSRF in prerendered error page fetchCVE-2026-54300Medium@astrojs/netlify: @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN configCVE-2026-54288Mediumhono: hono: Body Limit Middleware can be bypassed on AWS Lambda by understating `Content-Length`CVE-2026-54289Mediumhono: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the restCVE-2026-54290Highhono: hono: CORS Middleware reflects any Origin with credentials when `origin` defaults to the wildcardCVE-2026-54286Mediumhono: hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)CVE-2026-54287Mediumhono: hono: AWS Lambda adapter merges multiple `Set-Cookie` headers into one value, dropping cookies on ALB single-header and LatticeCVE-2026-50146Highastro: Astro: Reflected XSS via unescaped slot nameCVE-2026-53722Mediumnuxt: Nuxt: Reflected XSS in `<NuxtLink>` via unsanitised `javascript:` or `data:` URLCVE-2026-56301Mediumnuxt: Nuxt dev server vite-node IPC socket is world-connectable on LinuxCVE-2026-53721Highnuxt: Nuxt: Route-rule middleware bypass via case-sensitivity mismatch between vue-router and the routeRules matcherCVE-2026-56326Mediumnuxt: Nuxt: URL-handling weaknesses in `navigateTo` and `reloadNuxtApp`: SSR open redirect, client-side script execution via the `open` option,…CVE-2026-50880Criticalyoutransfer: YouTransfer has an issue in the sendmail transport integration that allows arbitrary code executionCVE-2026-30121Criticalremotion: Remotion: arbitrary file write vulnerabilityCVE-2026-30120Criticalremotion: Remotion: remote code execution (RCE) vulnerabilityGHSA-RQ7W-G337-39QQLownuxt: Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`CVE-2026-11417Highaws-cdk-lib: aws-cdk-lib: OS Command Injection in NodejsFunction BundlingCVE-2026-48988Mediummarkdown-it: markdown-it: Quadratic complexity DoS in smartquotes rule via replaceAt string operationsCVE-2026-54285Medium@opentelemetry/core: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagationCVE-2026-54281High@nestjs/platform-fastify: Nest: Middleware Bypass on Fastify via Trailing SlashCVE-2026-54257Criticalelectron: Electron: Buffer performs incorrect byte length calculations resulting in heap buffer under/overflowCVE-2026-48125Mediumua-parser-js: UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`CVE-2026-54271Highprotobufjs-cli: protobufjs-cli: Code injection in pbjs static output from crafted JSON descriptor namesCVE-2026-54270Mediumprotobufjs: protobufjs: Memory amplification from preserved unknown fields in binary decodeCVE-2026-65899Lowdompurify: DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo