npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-45061Highbudibase: Budibase vulnerable to SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)CVE-2026-45033High@github/copilot: GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorCVE-2026-44572Lownext: Next.js's Middleware / Proxy redirects can be cache-poisonedGHSA-MHWJ-73QX-JQXMHigh@theecryptochad/merge-guard: @theecryptochad/merge-guard has Prototype Pollution in its deepMerge() functionCVE-2026-44483High@rvf/set-get: @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data)CVE-2026-44581Mediumnext: Next.js vulnerable to cross-site scripting in App Router applications using CSP noncesCVE-2026-44582Lownext: Next.js vulnerable to cache poisoning via collisions in React Server Component cache-bustingCVE-2026-44580Mediumnext: Next.js has cross-site scripting in beforeInteractive scripts with untrusted inputCVE-2026-44579Highnext: Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache ComponentsCVE-2026-44577Mediumnext: Next.js has a Denial of Service in the Image Optimization APICVE-2026-44578Highnext: Next.js vulnerable to server-side request forgery in applications using WebSocket upgradesCVE-2026-44576Mediumnext: Next.js vulnerable to cache poisoning in React Server Component responsesCVE-2026-44575Highnext: Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routesCVE-2026-44574Highnext: Next.js has a Middleware / Proxy bypass through dynamic route parameter injectionCVE-2026-44573Highnext: Next.js has a Middleware / Proxy bypass in Pages Router applications using i18nGHSA-W94C-4VHP-22GXHigh@vitejs/plugin-rsc: @vitejs/plugin-rsc has a Denial of Service Vulnerability in React Server ComponentsGHSA-8H8Q-6873-Q5FJHighnext: Next.js Vulnerable to Denial of Service with Server ComponentsCVE-2026-23870Highreact-server-dom-parcel: Facebook React has a Denial of Service Vulnerability in React Server ComponentsCVE-2026-44902High@opentelemetry/exporter-prometheus: Prometheus exporter process crash via malformed HTTP requestCVE-2026-44458Mediumhono: Hono has CSS Declaration Injection via Style Object Values in JSX SSRCVE-2026-44459Lowhono: Hono has improper validation of NumericDate claims (exp, nbf, iat) in JWT verify()GHSA-V6WJ-C83F-V46XCritical@profullstack/mcp-server: @profullstack/mcp-server vulnerable to OS Command Injection in domain_lookup ModuleCVE-2026-44966Highvelocityjs: Velocity.js has a Prototype Pollution vulnerability through #set path assignmentCVE-2026-44457Mediumhono: Hono's Cache Middleware ignores Vary: Authorization / Vary: Cookie leading to cross-user cache leakageCVE-2026-44895High@yoda.digital/gitlab-mcp-server: @yoda.digital/gitlab-mcp-server's SSE transport has no authentication and wildcard CORS, exposing all 86 GitLab tools

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo