npm Package Vulnerabilities

All 2,955 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 7,171 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw531 CVEs
  2. 2.n8n156 CVEs
  3. 3.parse-server117 CVEs
  4. 4.flowise112 CVEs
  5. 5.electron79 CVEs
  6. 6.vm278 CVEs
  7. 7.ghost69 CVEs
  8. 8.next65 CVEs
  9. 9.directus56 CVEs
  10. 10.axios55 CVEs
  11. 11.undici55 CVEs
  12. 12.nocodb54 CVEs
  13. 13.hono52 CVEs
  14. 14.@budibase/server41 CVEs
  15. 15.apostrophe33 CVEs
  16. 16.dompurify32 CVEs
  17. 17.pnpm31 CVEs
  18. 18.flowise-components29 CVEs
  19. 19.payload29 CVEs
  20. 20.vite29 CVEs
  21. 21.@anthropic-ai/claude-code28 CVEs
  22. 22.astro28 CVEs
  23. 23.better-auth26 CVEs
  24. 24.nuxt25 CVEs
  25. 25.node-forge23 CVEs
  26. 26.nodemailer23 CVEs
  27. 27.@xmldom/xmldom23 CVEs
  28. 28.fuxa-server22 CVEs
  29. 29.tar21 CVEs
  30. 30.9router19 CVEs
  31. 31.liquidjs19 CVEs
  32. 32.@openzeppelin/contracts19 CVEs
  33. 33.react-router19 CVEs
  34. 34.@sveltejs/kit19 CVEs
  35. 35.tinymce19 CVEs
  36. 36.fastify18 CVEs
  37. 37.@openzeppelin/contracts-upgradeable18 CVEs
  38. 38.xmldom18 CVEs
  39. 39.fast-uri17 CVEs
  40. 40.protobufjs17 CVEs
  41. 41.sanitize-html17 CVEs
  42. 42.systeminformation17 CVEs
  43. 43.@backstage/plugin-scaffolder-backend16 CVEs
  44. 44.@haxtheweb/haxcms-nodejs16 CVEs
  45. 45.ckeditor415 CVEs
  46. 46.handlebars15 CVEs
  47. 47.jspdf15 CVEs
  48. 48.multer15 CVEs
  49. 49.sequelize15 CVEs
  50. 50.signalk-server15 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →