npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-X7MM-9VVV-64W8Lowunhead: unhead: Streaming SSR `streamKey` injected into inline script without identifier validationCVE-2026-41679Criticalpaperclipai: paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization BypassCVE-2026-40299Mediumnext-intl: next-intl has an open redirect vulnerabilityGHSA-75HX-XJ24-MQRWHighn8n-mcp: n8n-mcp has unauthenticated session termination and information disclosure in HTTP transportGHSA-6V7Q-WJVX-W8WGHighbasic-ftp: basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsCVE-2026-40190Mediumlangsmith: LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`CVE-2026-40175Mediumaxios: Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection ChainGHSA-59XV-588H-2VMMLow@saltcorn/data: @saltcorn/data vulnerable to SQL Injection via jsexprToSQL Literal HandlerCVE-2026-40163High@saltcorn/server: Saltcorn has an Unauthenticated Path Traversal in sync endpoints, allowing arbitrary file write and directory readCVE-2026-40074Medium@sveltejs/kit: @sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-ServiceCVE-2026-40073High@sveltejs/kit: @sveltejs/adapter-node has a BODY_SIZE_LIMIT bypassGHSA-V457-WXVJ-P9W9High@vitejs/plugin-rsc: @vitejs/plugin-rsc has a Denial of Service with React Server ComponentsGHSA-Q4GF-8MX6-V5V3Highnext: Next.js has a Denial of Service with Server ComponentsCVE-2026-23869Highreact-server-dom-parcel: React Server Components have a Denial of Service VulnerabilityCVE-2026-6011Lowopenclaw: OpenClaw vulnerable to SSRF in src/agents/tools/web-fetch.tsCVE-2026-5986Mediumjs-video-url-parser: Zod jsVideoUrlParser vulnerable to ReDoS in util.jsCVE-2026-41915Lowopenclaw: OpenClaw: GIT_DIR and related git plumbing env vars missing from exec env denylist (GHSA-m866-6qv5-p2fg variant)CVE-2026-39315Mediumunhead: Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()CVE-2026-42420Mediumopenclaw: OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size ChecksCVE-2026-42428Mediumopenclaw: OpenClaw B-M3: ClawHub package downloads are not enforced with integrity verificationCVE-2026-40037Highopenclaw: OpenClaw: `fetchWithSsrFGuard` replays unsafe request bodies across cross-origin redirectsGHSA-W9J9-W4CP-6WGRMediumopenclaw: OpenClaw Host-Exec Environment Variable InjectionCVE-2026-42430Mediumopenclaw: OpenClaw: Strict browser SSRF bypass in Playwright redirect handling leaves private targets reachableCVE-2026-42429Lowopenclaw: OpenClaw: Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write`CVE-2026-41912Mediumopenclaw: OpenClaw has Browser SSRF Policy Bypass via Interaction-Triggered Navigation

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo