Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
GHSA-qxpp-qjg8-x4jvHigh· 7.1Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)
GHSA-xxv7-2vv3-h682High· 7.7Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
Trigger.dev: Server-side request forgery via unvalidated webhook alert-channel URL
CVE-2026-104872Medium· 5.8OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentat…
CVE-2026-104871Medium· 6.3The Angular SSR is a server-rise rendering tool for Angular applications
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for ver…
CVE-2026-103918Medium· 6.5oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in pl…
CVE-2026-104861High· 7.5PoCprobe-image-size gets image dimensions without downloading the entire file
probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.js use the searching regular expression /<[-_.:a-zA-Z0-9][^>]*>/, which repeatedly scans to the en…
CVE-2026-104859High· 7.3Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker release pipeline builds docker tag, image lookup, and docker push invocations as shell command strings…
CVE-2026-104854High· 8.5Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 14.6.0 until 22.7.9 and 23.1.2, Nx creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary locations without owner-only directory an…
CVE-2026-104853Medium· 5.8Nx is a monorepo solution for TypeScript and polyglot codebases
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contain…
CVE-2026-104849Critical· 9.5PoCTinypool is a minimal Node.js worker thread pool implementation
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.f…
CVE-2026-104848Critical· 9.5PoCTinypool is a minimal Node.js worker thread pool implementation
Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherite…
CVE-2026-94544Medium· 4.2⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular req…
CVE-2026-94543Medium· 5.3Next.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a res…
CVE-2026-94486Medium· 5.4⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious webs…
CVE-2026-94485Medium· 5.3⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious we…
CVE-2026-94484Medium· 4.8Next.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a share…
CVE-2026-94483Medium· 6.5⚖ disputedNext.js is a React framework for building full-stack web applications
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized…
CVE-2026-104847High· 8.5ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents
ProseMirror's view component renders and manages the editable browser interface for ProseMirror documents. Prior to 1.42.3, prosemirror-view paste handling accepts attacker-provided HTML whose clipboard slice context contains attributes …
CVE-2026-104846Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bear…
CVE-2026-104845High· 7.5Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and d…
CVE-2026-104844Medium· 5.9PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because peri…
GHSA-wj4w-mc24-pcfmHigh· 6.5Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature
Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature
GHSA-r9w8-h9r3-54w4Highdevalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
CVE-2026-104182Medium· 6.2PoCstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comm…
CVE-2026-104183Medium· 5.1PoCstream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, Assembler materializes object properties with plain assignment, so an input key named __proto__ invokes th…
CVE-2026-96780High· 8.2figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered w…
CVE-2026-103923Low· 2.1⚖ disputedKaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web
KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting…
CVE-2026-103922Critical· 9.3PoCCapacitor is a cross-platform native runtime for web applications
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a…
CVE-2023-54404High· 7.5Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema…
Zod schema-validation library through 4.6.5, fixed in commit e06a510, contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema…
CVE-2026-103921High· 7.4GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// end…