npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49356Low@babel/core: @babel/core: Arbitrary File Read via sourceMappingURL CommentCVE-2026-50184Medium@angular/service-worker: @angular/service-worker: Request Credential & Cache Policy StrippingCVE-2026-50171High@angular/common: @angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)CVE-2026-50170High@angular/common: @angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCacheCVE-2026-52725Medium@angular/core: @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)CVE-2026-50169Medium@angular/service-worker: Angular Service Worker Policy-Bypass & Credential-Stripping VulnerabilitiesCVE-2026-50168High@angular/platform-server: @angular/platform-server: URL Parser Differential leading to SSRF Allowlist BypassCVE-2026-49982Hightmp: tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/templateCVE-2026-48779Highws: ws: Memory exhaustion DoS from tiny fragments and data chunksCVE-2026-54267High@angular/core: Angular Client Hydration DOM Clobbering & Response-Cache PoisoningCVE-2026-12208Mediumjsonata: jsonata: Function Binding Prototype Pollution via hasOwnProperty OverrideCVE-2026-44311Mediumfabric: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serializationGHSA-G7R4-M6W7-QQQRLowesbuild: esbuild allows arbitrary file read when running the development server on WindowsCVE-2026-48152High@budibase/server: Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URLCVE-2026-48151High@budibase/server: Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schemaCVE-2026-48150Critical@budibase/server: Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assignCVE-2026-48148Medium@budibase/server: Budibase: Unvalidated VectorDB Host Parameter Enables SSRFCVE-2026-48147Medium@budibase/backend-core: Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker CVE-2026-48146High@budibase/server: Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist ProtectionCVE-2026-48128Mediumbudibase: Budibase: SSRF via User-Controlled queryId in Automation Execute Query StepCVE-2026-48121Medium@langchain/langgraph-checkpoint-mongodb: LangGraph has NoSQL parameter injection in MongoDBSaver, allowing cross-tenant state accessCVE-2026-53782Medium@steipete/summarize: @steipete/summarize vulnerable to SSRF via podcast:transcript URL fetchCVE-2026-53781Medium@steipete/summarize-core: @steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media ResponsesCVE-2026-48049Medium@hapi/inert: @hapi/inert has a static-file confinement bypass via sibling-prefix pathCVE-2026-48068High@grpc/grpc-js: @grpc/grpc-js: A malformed request can cause a server crash

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo