npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-59879Highimmutable: Immutable.js `List` 32-bit trie overflow → unrecoverable DoS CVE-2026-59896Mediumhono: hono/jsx does not isolate context per request, leading to cross-request data disclosure CVE-2026-59895Mediumhono: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility CVE-2026-59897Mediumhono: Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication GHSA-FRVP-7C67-39W9Medium@hono/node-server: Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)GHSA-8MV7-9C27-98VCMediumastro: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered GHSA-HP3V-MFQW-H74CLow@astrojs/netlify: @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped CVE-2026-12590Lowbody-parser: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement CVE-2026-59730Low@astrojs/node: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect CVE-2026-59729Mediumastro: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)CVE-2026-59728Medium@astrojs/rss: @astrojs/rss: XML Injection via Unescaped RSS Feed Fields CVE-2026-59727Lowastro: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands GHSA-GCFJ-64VW-6MP9Highaxios: Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning GHSA-HCPX-6FM6-WX23Mediumaxios: Axios form serializer maxDepth bypass via {} metatoken GHSA-7Q8Q-RJ6J-MHJQMediumaxios: Axios: Nested axios option objects can consume polluted prototype values GHSA-MWF2-3PR3-8698Mediumaxios: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`GHSA-JQH4-M9W3-8HP9Mediumaxios: Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`GHSA-MMX7-HFXF-JPPXMediumaxios: Axios: Prototype pollution gadgets can alter axios request construction GHSA-F4GW-2P7V-4548Mediumaxios: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios CVE-2026-59876Mediumprotobufjs: protobufjs: Text Format string map parsing can mutate returned map object prototype CVE-2026-59877Mediumprotobufjs: protobufjs: Denial of Service via infinite loop in .proto option parsing CVE-2026-14631Mediumwebpack-dev-server: webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header CVE-2026-14620Mediumwebpack-dev-server: webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints CVE-2026-59731Highastro: Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch CVE-2026-59871Mediumtar: node-tar: Process crash via PAX numeric path type confusion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.