npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-5VJQ-5JMG-39XQMediumrenovate: Renovate affected by remote code execution was possible using the bazel-module or bazelisk managers, when using lockFileMaintenanceCVE-2026-41182Mediumlangsmith: LangSmith SDK: Streaming token events bypass output redactionCVE-2026-33808Critical@fastify/express: @fastify/express has a middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)CVE-2026-33807Critical@fastify/express: @fastify/express's middleware path doubling causes authentication bypass in child plugin scopesCVE-2026-33805Critical@fastify/reply-from: Fastify's connection header abuse enables stripping of proxy-added headersCVE-2026-41211Highvite-plus: Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOMECVE-2026-56761Mediumhono: hono Improperly Handles JSX Attribute Names Allows HTML Injection in hono/jsx SSRCVE-2026-65903Mediumdompurify: DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluationCVE-2026-40346Medium@nocobase/plugin-workflow-request: NocoBase has SSRF in Workflow HTTP Request and Custom Request PluginsCVE-2026-33806Highfastify: Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type HeaderCVE-2026-41161Medium@sync-in/server: Sync-in Server has Username Enumeration via Timing AttackCVE-2026-5758Mediumprotocol-buffers-schema: Mafintosh's protocol-buffers-schema is vulnerable to prototype pollutionGHSA-26WG-9XF2-Q495Highnovu/api: Novu has a XSS sanitization bypassGHSA-4X48-CGF9-Q33FHigh@novu/api: Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protectionCVE-2026-40887Critical@vendure/core: @vendure/core has a SQL Injection vulnerabilityCVE-2026-39884Highmcp-server-kubernetes: MCP Server Kubernetes has an Argument Injection in port_forward tool via space-splittingCVE-2026-40255Medium@adonisjs/http-server: @adonisjs/http-server has an Open Redirect vulnerabilityCVE-2025-61260Critical@openai/codex: OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration filesCVE-2025-13822Medium@samanhappy/mcphub: MCPHub has an authentication bypassCVE-2026-40895Mediumfollow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect TargetsCVE-2026-40879High@nestjs/microservices: Nest Affected by DoS via Recursive handleData in JsonSocket (TCP Transport)GHSA-P4H8-56QP-HPGVHigh@aiondadotcom/mcp-ssh: SSH/SCP option injection allowing local RCE in @aiondadotcom/mcp-sshCVE-2026-6216Lowdbgate-web: DbGate has cross site scripting via the SVG Icon String Handler componentCVE-2026-28291Highsimple-git: simple-git Affected by Command Execution via Option-Parsing BypassCVE-2026-41139Highmathjs: mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo