npm vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-35213High@hapi/content: @hapi/content: Regular Expression Denial of Service (ReDoS) in HTTP header parsingCVE-2026-35200Lowparse-server: Parse Server: File upload Content-Type override via extension mismatchCVE-2026-35042Highfast-jwt: fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)CVE-2026-25044High@budibase/server: Budibase: Command Injection in Bash Automation StepCVE-2026-34764Lowelectron: Electron: Use-after-free in offscreen shared texture release() callbackCVE-2026-34217Medium@nyariv/sandboxjs: SandboxJS: Sandbox Escape via Prop Object Leak in New HandlerCVE-2026-34211Medium@nyariv/sandboxjs: SandboxJS: Stack overflow DoS via deeply nested expressions in recursive descent parserCVE-2026-34208Critical@nyariv/sandboxjs: SandboxJS: Sandbox integrity escape CVE-2026-34083Mediumsignalk-server: Signal K Server: OAuth Authorization Code Theft via Unvalidated Host Header in OIDC FlowCVE-2026-33951Mediumsignalk-server: Signal K Server: Unauthenticated Source Priorities Manipulation CVE-2026-33950Criticalsignalk-server: Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity CVE-2026-31818Critical@budibase/backend-core: Budibase: Server-Side Request Forgery via REST Connector with Empty Default BlacklistCVE-2026-35039Criticalfast-jwt: fast-jwt: Cache Confusion via cacheKeyBuilder Collisions Can Return Claims From a Different Token (Identity/Authorization Mixup)CVE-2026-35038Lowsignalk-server: Signal K Server: Arbitrary Prototype Read via `from` Field BypassCVE-2026-65912Mediumdompurify: DOMPurify ADD_ATTR predicate skips URI validationCVE-2026-65913Mediumdompurify: DOMPurify USE_PROFILES prototype pollution allows event handlersGHSA-XG6X-H9C9-2M83Criticalbetter-auth: Better Auth Has Two-Factor Authentication Bypass via Premature Session Caching (session.cookieCache)CVE-2026-41382Lowopenclaw: OpenClaw: Discord voice ingress authorization can be bypassed via channel, name, and stale-role validation gapsCVE-2026-41341Lowopenclaw: OpenClaw: Discord Component Interaction Misclassifies Group DM as Direct MessageCVE-2026-41300Mediumopenclaw: OpenClaw: Endpoint persists after trust decline, leaking gateway credentialsCVE-2026-41403Mediumopenclaw: OpenClaw: diffs viewer misclassifies proxied remote requests as loopback when `allowRemoteViewer` is disabledCVE-2026-41348Lowopenclaw: OpenClaw: Discord Slash Commands Bypass Group DM Channel AllowlistCVE-2026-41393Highopenclaw: OpenClaw: macOS Tailnet DNS Spoofing & Credential ExfiltrationGHSA-F693-58PC-2GFRMediumopenclaw: OpenClaw: Telegram legacy allowFrom migration fans default-account trust into all named accountsCVE-2026-41388Lowopenclaw: OpenClaw: Tlon Startup Migration Rehydrates Empty-Array Revocations From File Config

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo