Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
GHSA-x5rw-q4pp-hg5gHighdevalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
GHSA-4q55-j62x-fr9hMediumdevalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
GHSA-wf3x-273g-mvxvLowdevalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
GHSA-mcm9-63f2-9j32Highdevalue: Repeated primitive strings cause quadratic expansion in uneval
devalue: Repeated primitive strings cause quadratic expansion in uneval
GHSA-hx4r-w6wj-j8fgMediumdevalue: Residual sparse-array CPU amplification in uneval
devalue: Residual sparse-array CPU amplification in uneval
CVE-2026-103004Medium· 5.3⚖ disputedNext.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params
Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with different root params. With Cache Components enabled (cacheComponents: true), a 'use cache' function …
CVE-2026-103288Medium· 6.5Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that the…
CVE-2026-102992Critical· 9.2PoCpiscina is a node.js worker pool implementation
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollu…
CVE-2026-102990High· 8.2PoCbasic-ftp is an FTP client for Node.js
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts b…
GHSA-p98j-92pf-mc4pLowDOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
CVE-2026-102983Medium· 6.3Astro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Be…
CVE-2026-102984High· 8.2Astro is a web framework for content-driven websites
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host …
CVE-2026-94545Medium· 5.3PoCSatori is a library to convert HTML and CSS to SVG
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be…
GHSA-prgh-xp8r-p3m5High· 7.5Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
Nodemailer addressparser: O(n^2) on comment-joined addresses enables a remote DoS (reachable via mailparser)
GHSA-9c5c-9qcx-q35qHigh· 7.4@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
GHSA-vcvr-r3jv-pc5jCriticalNext.js: Remote Code Execution in next/og ImageResponse
Next.js: Remote Code Execution in next/og ImageResponse
GHSA-96h4-vgxj-gvm2Medium· 6.5Nest: Unbounded memory growth in the NestJS TCP microservice transport
Nest: Unbounded memory growth in the NestJS TCP microservice transport
CVE-2026-55177High· 7.6PoCCloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK
CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family (api/routes/esri.ts) takes a fully attacker-controlled URL from the …
GHSA-c6fg-446q-cg94Medium· 5.3adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
adm-zip: getDataAsync() bypasses the maxOutputLength size guard enforced by the synchronous getData() path
GHSA-8238-w5pm-2374High· 7.5adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
GHSA-p634-w6r4-rjp2Medium· 5.9adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
adm-zip: Duplicate ZIP entry names: getEntry() and extractAllTo() resolve to different content
GHSA-v53p-9fqp-m79jHigh· 7.5Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
Nodemailer: Quadratic backtracking in the addressparser free-text fallback allows remote denial of service
GHSA-g57g-f23g-4646Medium· 5.3Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
Nodemailer: Quoted local-part can produce malformed envelope recipient through RFC 5322 comment parsing
CVE-2026-102829Critical· 9.2PoCsimple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 2.0.1 of the argv-parser package, parseEnv omits VISUAL from GitEnvKeys, so prepareEnv…
CVE-2026-102828Critical· 9.8simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer.<tok…
CVE-2026-102827High· 8.1PoCsimple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with liter…
CVE-2026-102826High· 8.1PoCsimple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuratio…
GHSA-r3ph-w7gj-g6xmMedium· 5.3js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
GHSA-253c-mchw-3w2rMediummarkdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
markdown-it linkify: true has two quadratic paths, so a few hundred KB of markdown blocks the event loop for tens of seconds
GHSA-6h2x-m376-mqjqHigh· 7.5joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`