npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-42565Medium@workos/authkit-session: @workos/authkit-session has an Open Redirect via state-derived redirect target GHSA-G485-8J3V-P6X8High@tdurieux/anonymous_github: @tdurieux/anonymous_github Vulnerable to XSS via Unsanitized GitHub Repository Content Rendering in Anonymous GitHub Origin CVE-2026-42047Highinngest: Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods CVE-2026-42045Medium@lobehub/lobehub: LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution CVE-2026-42856Highnetwork-ai: Network-AI missing authentication on MCP HTTP endpoint, which allows unauthenticated privileged tool calls CVE-2026-26956Criticalvm2: VM2 Has a WASM Sandbox Escape CVE-2026-26332Criticalvm2: VM2 Has a Sandbox Escape Issue via SuppressedError CVE-2026-24781Criticalvm2: VM2 Has Sandbox Breakout Through Inspect Function CVE-2026-24120Criticalvm2: VM2 Has Sandbox Breakout Through Promise Species CVE-2026-43570Mediumopenclaw: OpenClaw contains a symlink traversal vulnerability CVE-2026-43870Highthrift: Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource Consumption CVE-2026-42037Mediumaxios: Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream CVE-2026-42038Mediumaxios: Axios: no_proxy bypass via IP alias allows SSRF CVE-2026-42039Mediumaxios: Axios: unbounded recursion in toFormData causes DoS via deeply nested request data CVE-2026-42034Mediumaxios: Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 CVE-2026-42036Mediumaxios: Axios: HTTP adapter streamed responses bypass maxContentLength CVE-2026-42033Highaxios: Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking CVE-2026-42035Highaxios: Axios: Header Injection via Prototype Pollution CVE-2026-42042Mediumaxios: Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion CVE-2026-42041Mediumaxios: Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy CVE-2026-42043Highaxios: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0 CVE-2026-42044Mediumaxios: Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`CVE-2026-42264Highaxios: Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking CVE-2026-42040Lowaxios: Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams GHSA-93RG-2XM5-2P9VMediumopenclaw: OpenClaw's Gateway Control UI bootstrap config required Gateway auth

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.