npm Package Vulnerabilities

All 2,665 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 5,481 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw448 CVEs
  2. 2.n8n80 CVEs
  3. 3.flowise78 CVEs
  4. 4.parse-server59 CVEs
  5. 5.directus55 CVEs
  6. 6.electron49 CVEs
  7. 7.nocodb44 CVEs
  8. 8.next42 CVEs
  9. 9.vm241 CVEs
  10. 10.hono35 CVEs
  11. 11.axios33 CVEs
  12. 12.pnpm28 CVEs
  13. 13.undici27 CVEs
  14. 14.@anthropic-ai/claude-code25 CVEs
  15. 15.fuxa-server22 CVEs
  16. 16.vite22 CVEs
  17. 17.astro20 CVEs
  18. 18.ghost20 CVEs
  19. 19.@budibase/server19 CVEs
  20. 20.@openzeppelin/contracts19 CVEs
  21. 21.@openzeppelin/contracts-upgradeable18 CVEs
  22. 22.tinymce18 CVEs
  23. 23.ckeditor416 CVEs
  24. 24.flowise-components16 CVEs
  25. 25.@haxtheweb/haxcms-nodejs16 CVEs
  26. 26.tar16 CVEs
  27. 27.jspdf15 CVEs
  28. 28.nuxt15 CVEs
  29. 29.protobufjs15 CVEs
  30. 30.dompurify14 CVEs
  31. 31.joplin14 CVEs
  32. 32.nodebb14 CVEs
  33. 33.react-router14 CVEs
  34. 34.sequelize14 CVEs
  35. 35.signalk-server14 CVEs
  36. 36.systeminformation14 CVEs
  37. 37.angular13 CVEs
  38. 38.@directus/api12 CVEs
  39. 39.@evershop/evershop12 CVEs
  40. 40.jsrsasign12 CVEs
  41. 41.liquidjs12 CVEs
  42. 42.matrix-js-sdk12 CVEs
  43. 43.node-forge12 CVEs
  44. 44.@nyariv/sandboxjs12 CVEs
  45. 45.strapi12 CVEs
  46. 46.better-auth11 CVEs
  47. 47.electerm11 CVEs
  48. 48.handlebars11 CVEs
  49. 49.@lobehub/chat11 CVEs
  50. 50.marked11 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Start Free Scan →