Npm vulnerabilities

Products

• Cli 5
• Node-tar 5
• @fastify/oauth2 3
• Arborist 2
• Cached-path-relative 2
• Npm 2

Newest

• @fastify/oauth2 @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback CVE-2026-110008 4.2 MediumOctober 19, 2026
• @fastify/oauth2, fastify fastify\/oauth2 +1 more @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies CVE-2026-18165 4.2 MediumAugust 15, 2026
• cli, red hat confidential compute attestation, cryostat 4 +32 more +34 more npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability CVE-2026-0775 Fix available 7.0 HighJanuary 23, 2026
• fastify oauth2, npm @fastify/oauth2 +1 more @fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state CVE-2023-31999 Fix available 8.8 HighJuly 4, 2023
• izimodal project izimodal iziModal vulnerable to Cross-site Scripting CVE-2021-32860 Fix available 6.1 MediumFebruary 20, 2023
• b3log vditor vditor vulnerable to Cross-site Scripting CVE-2021-32855 Fix available 6.1 MediumFebruary 20, 2023
• npm textangular textAngular text editor vulnerable to Cross-site Scripting CVE-2021-32854 6.1 MediumFebruary 20, 2023
• erxes Erxes vulnerable to Cross-site Scripting CVE-2021-32853 6.1 MediumFebruary 20, 2023
• mind-elixir project mind-elixir jQuery MiniColors vulnerable to Cross-site Scripting CVE-2021-32851 Fix available 6.1 MediumFebruary 20, 2023
• jquery-minicolors project jquery-minicolors, npm @claviska/jquery-minicolors +1 more jQuery MiniColors vulnerable to Cross-site Scripting CVE-2021-32850 Fix available 6.1 MediumFebruary 20, 2023
• npm, netapp ontap select deploy administration utility +1 more npm packing does not respect root-level ignore files in workspaces CVE-2022-29244 Fix available 7.5 HighJune 2, 2022
• cached-path-relative project cached-path-relative, debian linux +1 more Prototype Pollution CVE-2021-23518 Fix available 7.3 HighJanuary 21, 2022
• npm, solarwinds network performance monitor +1 more Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 CVE-2021-35225 5.0 MediumOctober 21, 2021
• isaacs node-tar, npmjs tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization CVE-2021-37713 Fix available 8.2 HighAugust 31, 2021
• npm arborist, oracle graalvm, siemens sinec infrastructure network services +2 more UNIX Symbolic Link (Symlink) Following in @npmcli/arborist CVE-2021-39134 Fix available 8.2 HighAugust 31, 2021
• npm arborist, oracle graalvm, siemens sinec infrastructure network services +2 more UNIX Symbolic Link (Symlink) Following in @npmcli/arborist CVE-2021-39135 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, npmjs tar, debian linux +2 more +4 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37712 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, npmjs tar, debian linux +2 more +4 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links CVE-2021-37701 Fix available 8.2 HighAugust 31, 2021
• isaacs node-tar, tar project tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization CVE-2021-32804 Public exploitFix available EPSS 15.1% 8.2 HighAugust 3, 2021
• isaacs node-tar, tar project tar, oracle graalvm +1 more +3 more Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning CVE-2021-32803 Fix available 8.2 HighAugust 3, 2021
• cli, npmjs npm, fedoraproject fedora +1 more +3 more Sensitive information exposure through logs in npm cli CVE-2020-15095 Fix available 4.4 MediumJuly 7, 2020
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Arbitrary File Overwrite in npm CLI CVE-2019-16777 Fix available 7.7 HighDecember 13, 2019
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Unauthorized File Access in npm CLI before before version 6.13.3 CVE-2019-16776 Fix available 7.7 HighDecember 13, 2019
• cli, npmjs npm, fedoraproject fedora +4 more +6 more Unauthorized File Access in npm CLI before before version 6.13.3 CVE-2019-16775 Fix available 7.7 HighDecember 13, 2019
• knight project knight, npm knightjs +1 more Path Traversal in knightjs CVE-2018-16475 7.5 HighNovember 6, 2018
• npm tianma-static Stored Cross-Site Scripting in tianma-static CVE-2018-16474 6.1 MediumNovember 6, 2018
• npm takeapeek Path Traversal in takeapeek CVE-2018-16473 5.3 MediumNovember 6, 2018
• cached-path-relative project cached-path-relative, debian linux +1 more Prototype Pollution in cached-path-relative CVE-2018-16472 Fix available 7.5 HighNovember 6, 2018
• mosca project mosca Mosca REDoS Vulnerability CVE-2018-11615 Fix available 7.5 HighAugust 30, 2018