Tagged “npm”
CVEs tagged npm, newest first.
1548 CVEsRSS
CVE-2026-46350Lowdcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
GHSA-q84f-53jg-9ppmHigh· 8.1better-auth: Device login approval does not show the requesting client or permissions
better-auth: Device login approval does not show the requesting client or permissions
GHSA-4g23-2xm8-66gcMedium· 5.9Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
Nodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service
GHSA-g73g-hqqh-jr95Medium· 5.3Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped
GHSA-4ffr-jq9g-5ffxMedium· 5.9Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
Nodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service
GHSA-r4xp-prcw-77qfHigh· 7.4better-auth: OAuth Proxy lets an attacker sign in as another user
better-auth: OAuth Proxy lets an attacker sign in as another user
GHSA-44jh-23m7-hpcfLow· 3.7@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL
CVE-2026-114607Critical· 9.1better-auth: OAuth state can be used as a Magic Link to sign in as another user
better-auth: OAuth state can be used as a Magic Link to sign in as another user
GHSA-85x2-q946-cp5hMedium· 6.5Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
GHSA-m943-m63m-w62wMedium· 6.5Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
GHSA-8c8m-p3m8-cjg8Medium· 6.5Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
GHSA-h4fr-cmh5-qr62Low· 3.3Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
GHSA-f2hq-32vh-53ccHigh· 7.5postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
CVE-2026-115897Low· 2.1⚖ disputedSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-in…
CVE-2026-115895High· 8.8Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
GHSA-2rqm-h6hv-g79vMedium· 6.1odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
CVE-2026-115569Low· 3.3Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
CVE-2026-115570High· 7.4Electron: Mitigation for compromised eMudhra intermediate certificates
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromi…
CVE-2026-115478High· 7.1obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
CVE-2026-115477High· 7.1obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2026-113872High· 7.5PoCmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-111181High· 7.5body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-114060Low· 4.7SvelteKit: URL redirection to untrusted site via enhanced form submission
SvelteKit: URL redirection to untrusted site via enhanced form submission
CVE-2026-114061Low· 4.7SvelteKit : XSS via untrusted cache-control header in prerendered page
SvelteKit : XSS via untrusted cache-control header in prerendered page
CVE-2026-110725Low· 3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
CVE-2026-110180Medium· 4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
CVE-2026-110095Low· 3.7fast-uri vulnerable to improper path equivalence in relative reference normalization
fast-uri vulnerable to improper path equivalence in relative reference normalization
CVE-2026-110306Medium· 6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
GHSA-2464-fhr4-w9xwCriticalNext.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used
CVE-2026-94482High· 8.2Next.js: Denial of Service in App Router using Server Actions
Next.js: Denial of Service in App Router using Server Actions