npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-65122Highyoutube-regex: youtube-regex vulnerable to Regex Denial of Service CVE-2025-63703Criticalparse-ini: parse-ini is vulnerable to Prototype Pollution in index.js()GHSA-54PG-9963-V8VGCriticalintercom-client: Compromised version of intercom-client published to npm CVE-2026-42553Highcinny: Cinny vulnerable to access token disclosure via invalidated emoji pack avatar URL in service worker CVE-2025-63706Critical@jswork/next-npm-version: next-npm-version is vulnerable to Command injection CVE-2025-63705Highnode-ts-ocr: node-ts-ocr is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js CVE-2026-44007Criticalvm2: vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution CVE-2026-43998Highvm2: vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape CVE-2026-44003Mediumvm2: vm2's Transformer Fast-Path Bypass Exposes Internal State Variable CVE-2026-44002Mediumvm2: vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak CVE-2026-44000Mediumvm2: vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary CVE-2026-44004Highvm2: vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion CVE-2026-44001Highvm2: vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)CVE-2026-43999Criticalvm2: vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape CVE-2026-44005Criticalvm2: vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape CVE-2026-43997Criticalvm2: vm2 Access to Host Object Enables Sandbox Escape CVE-2026-44006Criticalvm2: vm2 has a Sandbox Escape Vulnerability CVE-2026-44503Highcom.microsoft.kiota:microsoft-kiota-abstractions: Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect CVE-2026-44479Mediumvercel: Vercel: Non-interactive mode includes CLI arguments in suggested command output CVE-2026-44456Mediumhono: Hono: bodyLimit() can be bypassed for chunked / unknown-length requests CVE-2026-44455Mediumhono: hono/jsx has Unvalidated JSX Tag Names that May Allow HTML Injection CVE-2026-44437Medium@angular/ssr: Angular SSR has Open Redirect and Request Steering via Encoded X-Forwarded-Prefix GHSA-CQMH-PCGR-Q42FMedium@axonflow/openclaw: @axonflow/openclaw fix introduces plugin cache and credential-file permission hardening GHSA-MPH8-9V29-PM42Medium@axonflow/sdk: axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification CVE-2026-44374Medium@backstage/plugin-catalog-unprocessed-entities-common: Backstage: Catalog unprocessed read endpoints allow authenticated cross-owner data access without permission checks

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.