npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-47144Mediumshamefile: Shamefile has an arbitrary file read via shamefile.yaml in shame nextCVE-2026-9673Mediumjson-2-csv: json-2-csv vulnerable to CSV Injection via the preventCsvInjection optioCVE-2026-47717Highfuxa-server: FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device ConfigurationsCVE-2026-45618Criticalliquidjs: LiquidJS is Vulnerable to Remote Code ExecutionCVE-2026-45617Highliquidjs: LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter RegexCVE-2026-45357Highliquidjs: LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)CVE-2026-44979Medium@hapi/wreck: @hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirectsCVE-2026-44974High@hapi/content: @hapi/content header parser has a parameter smuggling issue that allows upload-filter bypass via duplicate parametersCVE-2026-44705Hightmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escapeCVE-2026-44646Mediumliquidjs: LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()`CVE-2026-44645Mediumliquidjs: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` bodyCVE-2026-44644Mediumliquidjs: LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSSCVE-2026-43947Highfuxa-server: FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization BypassCVE-2026-43946Highfuxa-server: FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValueCVE-2026-43945High@frangoteam/fuxa: FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration InjectionCVE-2026-42462High@fedify/fedify: Fedify has an LD-Signature Bypass via JSON-LD Named-Graph RestructuringCVE-2026-42089Highyeoman-environment: yeoman-environment Vulnerable to Arbitrary Package Installation without User ConfirmationCVE-2026-26028Mediumcryptpad: CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSSCVE-2026-39964Medium@typebot.io/js: Typebot.io has stored XSS via `javascript`: URI in text bubble links — bot author executes JS on visitors' browsersCVE-2026-28445High@typebot.io/js: Typebot has Stored XSS via Rating Block Custom Icon that Bypasses isUnsafe Sandbox in Builder PreviewCVE-2026-9496Highpacote: pacote is vulnerable to Denial of Service (DoS) via the addGitSha functionCVE-2026-9495Medium@koa/router: @koa/router has an Access Control BypassCVE-2026-9520Lowblitz: Blitz has a Cross-site Scripting issueCVE-2026-45249Mediumecharts: Apache ECharts has a cross-site scripting (XSS) vulnerabilityCVE-2026-9358Lowpostcss-selector-parser: postcss-selector-parser allows denial of service through uncontrolled AST recursion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo