npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-53663Lowreact-router: React Router: Potential CSRF via PUT/PATCH/DELETE document requestsCVE-2026-53633Critical@vitest/browser: Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCECVE-2026-65900Lowdompurify: DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modesCVE-2026-49978Mediumdompurify: DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.contentCVE-2026-65901Lowdompurify: DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via…CVE-2026-65902Mediumdompurify: DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` /…CVE-2026-49458Mediumdompurify: DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checksCVE-2026-49459Mediumdompurify: DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOMGHSA-268H-HP4C-CRQ3Mediumnodemailer: Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injectionGHSA-WQVQ-JVPQ-H66FMediumnodemailer: Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalizationCVE-2026-82662Highnodemailer: Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential InterceptionCVE-2026-48712Highprotobufjs: protobufjs: Denial of service through unbounded Any expansion during JSON conversionCVE-2026-54269Mediumprotobufjs: protobufjs : Schema-derived names can shadow runtime-significant propertiesCVE-2026-12143Highform-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenamesCVE-2026-54264High@angular/service-worker: @angular/service-worker: Sensitive Header Leakage on Cross-Origin Redirects in Angular Service WorkerCVE-2026-54268High@angular/common: @angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)CVE-2026-54266High@angular/common: @angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State PoisoningCVE-2026-54265Medium@angular/compiler: @angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)CVE-2026-50557Medium@angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)CVE-2026-50556High@angular/platform-server: @angular/platform-server: Missing `<noscript>` Raw-Text Serialization Escaping leads to Cross-Site Scripting (XSS) in Angular SSRCVE-2026-50555High@angular/platform-server: @angular/platform-server: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-53655Mediumtar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file…CVE-2026-53632Mediumlaunch-editor: launch-editor: NTLMv2 hash disclosure via UNC path handling on WindowsCVE-2026-53571Mediumvite: vite: `server.fs.deny` bypass on Windows alternate pathsCVE-2026-53550Mediumjs-yaml: JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo