npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-JPVJ-WPMJ-H7RVCritical@cap-js/openapi: Supply chain compromise via malicious @cap-js/openapiCVE-2026-47676Mediumhono: Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsCVE-2026-47674Mediumhono: Hono: IP Restriction bypasses static deny rules for non-canonical IPv6 CVE-2026-47675Mediumhono: Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injectionCVE-2026-47673Mediumhono: Hono: JWT middleware accepts any Authorization scheme, not only BearerCVE-2026-34077Highreact-router: React Router vulnerable to Denial of Service via reflected user input in single-fetchCVE-2026-45337Highbetter-auth: Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pendingCVE-2026-44496Highaxios: Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name InjectionCVE-2026-44488Highaxios: Allocation of Resources Without Limits or Throttling in AxiosCVE-2026-44487Highaxios: Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP AdapterCVE-2026-44486Highaxios: Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connectionCVE-2026-10802Low@keystone-6/core: Keystone: GraphQL API Endpoint Lacks Query Depth LimitsCVE-2026-49143Highbrowserstack-runner: browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handlerCVE-2026-49144Highbrowserstack-runner: browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP serverCVE-2026-42342Highreact-router: React Router vulnerable to DoS via unbounded path expansion in __manifest endpointCVE-2026-42211Highreact-router: React Router's vendored turbo-stream v2 allows arbitrary constructor invocation via TYPE_ERROR deserialization leading to Unauth RCECVE-2026-40181Mediumreact-router: React Router's same-origin redirect with path starting // causes open redirect via protocol-relative URL reinterpretationCVE-2026-33245Highreact-router: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targetsCVE-2026-33244Mediumreact-router: React Router has stored XSS via unescaped Location header in prerendered redirect HTMLCVE-2024-52011Highlaunch-editor: launch-editor vulnerable to command injection via the crafted request on WindowsCVE-2026-10691Low@wonderwhy-er/desktop-commander: DesktopCommanderMCP is vulnerable to Uncontrolled Resource ConsumptionCVE-2026-10690Low@wonderwhy-er/desktop-commander: DesktopCommanderMCP is vulnerable to SSRFCVE-2026-10291Medium@enderfga/claw-orchestrator: Claw Orchestrator has inefficient regular expression complexity via validateRegex()CVE-2026-10281Medium@enderfga/claw-orchestrator: Claw Orchestrator is missing authentication for the component API EndpointCVE-2026-47428Critical@vitest/browser: Vitest browser mode serves unsanitized otelCarrier query parameter as inline script

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo