Tagged “npm”
CVEs tagged npm, newest first.
1673 CVEsRSS
GHSA-gm3r-q2wp-hw87HighShescape: Quadratic-time denial of service in the flag-protection
Shescape: Quadratic-time denial of service in the flag-protection
GHSA-3r53-75j5-3g7jMedium· 5.6Quasar: Prototype pollution in the extend() utility
Quasar: Prototype pollution in the extend() utility
CVE-2026-44907High· 7.5react-server-dom: Denial of Service in Server Functions
react-server-dom: Denial of Service in Server Functions
GHSA-j9fc-w3mr-x6mvHigh· 8.8Budibase: Privilege escalation via public role assignment API missing app-level authorization
Budibase: Privilege escalation via public role assignment API missing app-level authorization
GHSA-4qcj-m5wp-jmf4Medium· 4.3Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
GHSA-fcrw-f7gg-6g9fMedium· 4.9Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users
GHSA-c8vc-7pv3-g98pHighBudibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountId not validated against session)
GHSA-q6x4-v3qx-85qwCritical· 9.6Budibase: SQL Injection via `multipleStatements: true`
Budibase: SQL Injection via `multipleStatements: true`
GHSA-ppr4-5f46-j9c6HighBudibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCertificateKeyFile
GHSA-xcx6-4f2g-hhgxHigh· 7.7Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
Budibase: S3 presigned URL endpoint authorization regression in v3.39.4 allows BASIC users to obtain S3 PutObject presigned URLs
GHSA-xg5g-26x8-cvf4High· 8.5Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
Budibase: DNS rebinding SSRF bypasses remain in OpenAPI import and REST query execution
GHSA-hp6v-6jw7-gv2fCriticalBudibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified
GHSA-mqhr-6j6h-74p5CriticalBudibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak
GHSA-hr66-5mqr-8mpxHigh· 7.5Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint
GHSA-gh4h-34gr-87r7Medium· 5.7Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders
GHSA-qw6m-8fw2-2v64High· 8.3Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
Budibase: NoSQL Injection via JSON Parameter Interpolation in MongoDB Query Execution
GHSA-2xgg-r2wc-c5r2High· 7.6Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
CVE-2026-15074High· 7.5@fastify/static vulnerable to route guard bypass via path traversal
@fastify/static vulnerable to route guard bypass via path traversal
CVE-2026-7120Medium· 5.3@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
@fastify/static vulnerable to Authorization Bypass via Non-Canonical URL Paths
GHSA-464c-974j-9xm6Low· 3.3AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion
GHSA-qwww-vcr4-c8h2HighReact Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
GHSA-pm4m-ph32-ghv5High· 7.5js-yaml: Exponential parsing time in flow collections leads to denial of service
js-yaml: Exponential parsing time in flow collections leads to denial of service
GHSA-rjg6-39jm-rgg4Critical· 9.9@better-auth/scim: account takeover and stale access via SCIM provider-id collision
@better-auth/scim: account takeover and stale access via SCIM provider-id collision
GHSA-h3rm-78g3-j7cpHigh· 7.1@better-auth/stripe: cross-organization billing tampering in organization subscription actions
@better-auth/stripe: cross-organization billing tampering in organization subscription actions
GHSA-qq9h-g4jm-xgf3High· 8.3Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
Better Auth: Account takeover via pre-account hijacking on magic-link and email-OTP sign-in
GHSA-wqjv-9729-c5q2Medium· 5.3SvelteKit: Big remote form function payloads can cause Node process to crash
SvelteKit: Big remote form function payloads can cause Node process to crash
GHSA-866w-xmhq-wj7xMedium· 4.3SvelteKit: Prototype pollution in file input deletion path in remote-function forms
SvelteKit: Prototype pollution in file input deletion path in remote-function forms
CVE-2026-59952MediumValibot: record() issue paths can make flatten() throw for inherited Object property names
Valibot: record() issue paths can make flatten() throw for inherited Object property names
GHSA-53g2-mvcc-q9x3Medium· 4.6Trix: Stored XSS via HTMLParser attribute injection on paste
Trix: Stored XSS via HTMLParser attribute injection on paste
GHSA-38hq-7x33-php4Medium· 4.7@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
@backstage/plugin-auth-backend: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass