npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-44372Mediumnitro: Nitro has an Open Redirect via Protocol-Relative URL Bypass in Wildcard Route RulesCVE-2026-44373Mediumnitro: Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules`CVE-2026-44351Criticalfast-jwt: fast-jwt: JWT auth bypass due to empty HMAC secret accepted by async key resolverCVE-2026-44240Highbasic-ftp: basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingCVE-2026-44232Highdssrf: dssrf: every IPv6 category bypasses is_url_safeGHSA-4C35-WCG5-MM9HMediumnext-intl: next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keysGHSA-R27J-894H-3W3PLowicu-minify: mcp-data-vis vulnerable to denial of service via unsanitized `select` key lookup on `Object.prototype` with `precompile: true`CVE-2026-42280Highauth0-js: Auth.js SDK has Improper Permission CheckingCVE-2026-8026Mediumflowise: Flowise: Bcrypt Password Hash ExposureCVE-2026-44217Mediumsse-channel: sse-channel: SSE Injection via unsanitized event fieldsCVE-2026-42338Mediumip-address: ip-address has XSS in Address6 HTML-emitting methodsCVE-2026-42334Highmongoose: Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL InjectionGHSA-JXH8-JH77-XH6GHigh@evomap/evolver: @evomap/evolver's validator sandbox allowlist permits `npm`/`npx`, yielding RCE from Hub-delivered validation tasks via lifecycle scriptsGHSA-7XP7-M392-H92CMedium@evomap/evolver: @evomap/evolver has an unbounded request body in proxy /asset/submit that causes persistent disk-exhaustion DoSGHSA-CFCJ-HQPF-HCCFHigh@evomap/evolver: @evomap/evolver: Path Traversal in `evolver fetch` default-branch `safeId` allows Hub-controlled overwrite of project files (RCE)CVE-2026-42281Criticalmagicmirror: MagicMirror vulnerable to unauthenticated SSRF via /cors endpointCVE-2026-42260Highopen-websearch: open-websearch has SSRF in `fetchWebContent` MCP tool: bracketed IPv6 literals and non-resolving hostname check bypass…CVE-2026-43930Lowparse-server: parse-server: MFA SMS one-time password accepted twice under concurrent loginCVE-2026-43929Highssrfcheck: ssrfcheck Vulnerable to Server-Side Request Forgery (SSRF) and Incomplete List of Disallowed InputsCVE-2025-8267Highssrfcheck: ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as InvalidCVE-2026-43897Highlink-preview-js: link-preview-js vulnerable to IPv6 and internal loopback attacksCVE-2026-43893Highexiftool-vendored: exiftool-vendored vulnerable to argument injection via newline characters in tag namesGHSA-CWJ3-VQPP-PMXRHighopenclaw: OpenClaw's gateway config mutation guard allowed unsafe model-driven config writesCVE-2026-45004Highopenclaw: OpenClaw vulnerable to arbitrary code execution via attacker-controlled setup-api.js loaded from cwd during env-key resolutionCVE-2026-45005Mediumopenclaw: OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo