npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47429Criticalvitest: When Vitest UI server is listening, arbitrary file can be read and executedCVE-2026-47423Highdompurify: DOMPurify XSS via selectedcontent re-cloneCVE-2026-50287High@agenticmail/mcp: @agenticmail/mcp Missing Authentication for Critical FunctionCVE-2026-47255High@agenticmail/api: AgenticMail API/storage and outbound relay hardening fixesCVE-2026-47248Mediumparse-server: Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callersCVE-2026-47141Mediumvm2: NodeVM observability builtins leak host process and HTTP request dataCVE-2026-47139Highvm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_serverCVE-2026-47140Criticalvm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionCVE-2026-8813Highexifreader: ExifReader is vulnerable to denial of service via crafted ICC `mluc` tagCVE-2026-8814Mediumexifreader: ExifReader is vulnerable to denial of service via unbounded decompression of image metadataCVE-2026-47210Criticalvm2: vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassCVE-2026-47137Criticalvm2: vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCECVE-2026-47209Highvm2: vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainCVE-2026-47135Highvm2: vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksCVE-2026-47208Criticalvm2: vm2 is Vulnerable to Sandbox Breakout Through Promise SpeciesGHSA-Q3FM-4WCW-G57XLowvm2: vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatterCVE-2026-47131Criticalvm2: vm2 has a Sandbox Escape issueCVE-2026-47200Mediumnuxt: Nuxt's route middleware is not enforced when rendering `.server.vue` pages via `/__nuxt_island/page_*`CVE-2026-44495Highaxios: axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config MergeCVE-2026-44494Highaxios: axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`CVE-2026-44492Highaxios: axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)CVE-2026-44490Mediumaxios: axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functionsCVE-2026-44489Lowaxios: Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype FixCVE-2026-48527High@haxtheweb/haxcms-nodejs: HaxCMS has a stored Cross-Site Scripting (XSS) bypass in its saveNode endpointCVE-2026-47718Mediumfuxa-server: FUXA provides guest and invalid-token access to protected read APIs in secure mode

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo