Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
CVE-2026-54666High· 8.3swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
CVE-2026-54658Critical· 9.8@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution
CVE-2026-54639High· 8.8Style Dictionary - Prototype Pollution in convertTokenData utility function
Style Dictionary - Prototype Pollution in convertTokenData utility function
CVE-2026-52888Medium· 6.8NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass
CVE-2026-54545High· 7.1@wakaru/cli arbitrary file write during bundle unpack
@wakaru/cli arbitrary file write during bundle unpack
GHSA-vg6v-j97m-h5xqMedium· 6.8@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
@novu/application-generic: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
CVE-2026-47219High· 7.5find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219)
A flaw was found in find-my-way, a routing module for Node.js. A remote attacker could exploit this vulnerability when find-my-way is used with Node's HTTP/2 server. By sending specially crafted HTTP/2 method values, an attacker can cause …
CVE-2026-54272High· 7.2ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifie…
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
A flaw was found in React Router. An unauthenticated attacker can send targeted requests to the manifest endpoint, leading to a denial of service (DoS). This can put a heavy load on the server, significantly slowing down response times and…
CVE-2026-53669Medium· 5.4react-router: React Router: Open Redirect vulnerability via backslashes in navigation components (CVE-2026-53669)
A flaw was found in React Router, a routing library for React applications. A remote attacker could exploit this vulnerability by crafting a malicious link that uses backslashes within the <Link> or useNavigate components. This could lead …
CVE-2026-45623High· 7.5postcss: PostCSS: Information disclosure and denial of service via crafted CSS input (CVE-2026-45623)
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can l…
CVE-2026-64648High· 7.5next: Next.js: Information disclosure via server-side fetch cache (CVE-2026-64648)
A flaw was found in Next.js. A remote attacker could exploit a vulnerability in the server-side fetch mechanism, where a request with a body might receive a cached response intended for a different request to the same URL but different bod…
CVE-2026-64649High· 8.2next: Next.js: Server-Side Request Forgery via malicious host redirection in Server Actions (CVE-2026-64649)
A flaw was found in Next.js, a framework for building web applications. A remote attacker can exploit this vulnerability by manipulating Host-associated headers when a Server Action forwards or redirects a request. This can lead to Server-…
CVE-2026-64641High· 7.5next: Next.js: Denial of Service via crafted requests to App Router with Server Actions (CVE-2026-64641)
A flaw was found in Next.js, a React framework for building web applications. A remote attacker can send specially crafted requests to Next.js applications that utilize the App Router with Server Actions. This can lead to excessive CPU usa…
CVE-2026-64642High· 8.2next: Next.js: Authentication bypass leading to unauthorized access (CVE-2026-64642)
A flaw was found in Next.js, a React framework. A remote attacker can bypass authentication in Next.js applications using App Router built with Turbopack and a single entry in config.i18n.locales by sending crafted requests. This vulnerabi…
CVE-2026-64645High· 8.2next: Next.js: Server-Side Request Forgery vulnerability (CVE-2026-64645)
A flaw was found in Next.js, a React framework for building web applications. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) or Open Redirect attacks. When a `rewrites()` or `redirects()` rule con…
CVE-2026-64646High· 7.5next: Next.js: Denial of Service via excessive memory consumption in Server Actions (CVE-2026-64646)
A flaw was found in Next.js. An attacker sending specially crafted requests to a Next.js application utilizing the App Router with Server Actions configured to use the Edge runtime can cause excessive memory consumption. This can lead to a…
GHSA-jxrp-r7gx-q4j8Medium· 6.1Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
Duplicate Advisory: DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
CVE-2026-66010Medium· 6.1PoCdompurify: DOMPurify: Cross-Site Scripting (XSS) via custom element attribute bypass (CVE-2026-66010)
A flaw was found in DOMPurify. This vulnerability allows attackers to bypass application security policies by preserving sensitive attributes on custom elements. These attributes can then be re-injected into web page content, leading to Cr…
GHSA-8q49-2h5h-434xMedium· 5.9FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
GHSA-pvcr-8mvp-w8qrHigh· 7.7Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
GHSA-cr7p-cr3q-h5cmMedium· 5.3Budibase: Account Enumeration via Login Lockout Response Differential
Budibase: Account Enumeration via Login Lockout Response Differential
GHSA-pmpg-2mxq-6xwrHigh· 7.1Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
Budibase: NoSQL injection in MongoDB integration: collection dump, $where JS exec, cross-collection pivot, arbitrary update/delete
GHSA-v42f-v8xc-j435High· 8.5Budibase: SSRF via DNS rebinding in the REST datasource integration
Budibase: SSRF via DNS rebinding in the REST datasource integration
GHSA-hfhx-w8p8-4hc7MediumBudibase: SSRF via bare fetch() in uploadUrl during AI table generation
Budibase: SSRF via bare fetch() in uploadUrl during AI table generation
GHSA-g5vv-q72c-7j78High· 7.5@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion
GHSA-vh45-f885-3848Critical· 9.1sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock
GHSA-6v4m-fw66-8r4xMediumShescape: Path disclosure on Unix with Zsh
Shescape: Path disclosure on Unix with Zsh
GHSA-w4hw-qcx7-56prCriticalShescape: Shell injection via unescaped parentheses on Windows with CMD
Shescape: Shell injection via unescaped parentheses on Windows with CMD
GHSA-q53c-4prm-w95qMediumShescape: Home-directory disclosure in assignment context on Unix with Dash
Shescape: Home-directory disclosure in assignment context on Unix with Dash