Tagged “npm”
CVEs tagged npm, newest first.
1548 CVEsRSS
GHSA-mrv2-3pqr-j5jrHighDOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
GHSA-cg2g-xh64-v4q7CriticalDOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
GHSA-c6gr-qvv4-5v3fLowDOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
CVE-2026-114604HighGraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments
GHSA-673q-mjm6-r5xrCriticalNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
CVE-2026-114139Critical· 9.1Sentry-Javascript: Middleware Bypass when using Tunnel route
Sentry-Javascript: Middleware Bypass when using Tunnel route
CVE-2026-114143High· 8.7toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
CVE-2026-114142High· 8.8toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
CVE-2026-114144High· 7.5toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
CVE-2026-114130Low· 2.3Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
CVE-2026-114131Medium· 6.5Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
CVE-2026-114129Medium· 6.2stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
CVE-2026-114133Medium· 5.4Nuxt server islands render `useHeadSafe` input without sanitisation
Nuxt server islands render `useHeadSafe` input without sanitisation
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron: Pointer lock permission requests can be attributed to the wrong frame
CVE-2026-114121Medium· 5.4Electron: openExternal permission requests can be attributed to the wrong origin
Electron: openExternal permission requests can be attributed to the wrong origin
CVE-2026-114122Low· 3.9Electron: Frame subscription trusts GPU-supplied frame geometry
Electron: Frame subscription trusts GPU-supplied frame geometry
CVE-2026-111997Medium· 5.3PoCip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process
GHSA-85pr-xr59-r75hLow· 4.7Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
GHSA-pvhg-7v4p-f5q9Low· 4.7Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions
CVE-2026-114141High· 8.7toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() function in lib/compiler.js rescans the complete assignedPaths and valueAssignments bookkeeping sets for every array-of-t…
CVE-2026-62197Medium· 8.5OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
CVE-2026-114124Low· 3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 44.4.3, and 45.0.0-alpha.9, frame data received from the GPU process for macOS offscreen rendering…
CVE-2026-114126High· 8.8storybook: storybook: Arbitrary code execution via exposed WebSocket authentication token (CVE-2026-114126)
A flaw was found in Storybook, which may lead to arbitrary code execution. The development server exposes its WebSocket authentication token to clients loading its web pages across a local area network (LAN). An attacker on the local netwo…
CVE-2026-114127Medium· 5.4⚖ disputedastro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)
A flaw was found in Astro. Its server-side View Transition stylesheet generator fails to properly sanitize animation properties when creating transition styles. A remote attacker able to supply input to these properties can inject arbitrar…
CVE-2026-114128Medium· 6.1astro: astro: Cross-Site Scripting via unescaped dynamic content in script and style elements (CVE-2026-114128)
A flaw was found in Astro. The rendering engine fails to properly sanitize dynamic values placed inside script and style elements, mistakenly treating them as trusted markup. A remote attacker can exploit this issue by supplying crafted in…
CVE-2026-114132Medium· 6.3Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only b…
CVE-2026-114125High· 8.8storybook: Storybook: Arbitrary code execution via insufficient message-origin restrictions (CVE-2026-114125)
A flaw was found in Storybook. Due to insufficient iframe embedding and message-origin restrictions, a remote attacker can achieve arbitrary code execution if a developer running a local development server visits a malicious website. By tr…
CVE-2026-113796Medium· 4.2Electron: SameSite cookie restrictions are not applied to windows opened from links
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as applicat…
CVE-2026-113800Medium· 5.4Electron: HID and USB permission checks can be attributed to the wrong origin
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.5, hid and usb permission checks made from an iframe caused setPermission…