npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-114127Lowastro: Astro: Arbitrary CSS injection in Astro View TransitionsCVE-2026-114604High@graphql-tools/utils: GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segmentsGHSA-CG2G-XH64-V4Q7Criticaldompurify: DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modesGHSA-MRV2-3PQR-J5JRHighdompurify: DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for…GHSA-C6GR-QVV4-5V3FLowdompurify: DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xmlCVE-2026-111997Mediumip-address: ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the…CVE-2026-103004Mediumnext: next.js cache leak across root param values in nested 'use cache' functionsCVE-2026-110871Mediumnodemailer: Nodemailer: Quadratic (O(n^2)) DKIM header unfolding lets a large folded header cause remote denial of service during signingCVE-2026-114139Critical@sentry/nextjs: Sentry-Javascript: Middleware Bypass when using Tunnel routeGHSA-2464-FHR4-W9XWCriticalnext: Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are usedCVE-2026-94482Highnext: Next.js: Denial of Service in App Router using Server ActionsCVE-2026-114129Mediumstream-json: stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of serviceCVE-2026-112948Medium@vitest/ui: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112949Medium@vitest/mocker: Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112950Medium@vitest/mocker: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fixCVE-2026-112953Medium@apostrophecms/import-export: ApostropheCMS: Exposure of Sensitive Information via predictable export filenamesCVE-2026-62197Mediumopenclaw: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLsCVE-2026-114125Criticalstorybook: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesCVE-2026-113800Mediumelectron: Electron: HID and USB permission checks can be attributed to the wrong originCVE-2026-112952Mediumapostrophe: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userCVE-2026-112957Mediumapostrophe: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to…CVE-2026-112958Mediumapostrophe: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute SerializationCVE-2026-113648Low@apostrophecms/import-export: ApostropheCMS: Missing Authentication in `cleanExport` RouteCVE-2026-112954Mediumapostrophe: ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APICVE-2026-112951Mediumapostrophe: ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo