npm Package Vulnerabilities

All 2,957 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 7,177 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 201.mcp-server-kubernetes5 CVEs
  2. 202.@modelcontextprotocol/sdk5 CVEs
  3. 203.moment5 CVEs
  4. 204.mysql25 CVEs
  5. 205.nanoid5 CVEs
  6. 206.nuxt-og-image5 CVEs
  7. 207.nx5 CVEs
  8. 208.oneuptime5 CVEs
  9. 209.path-to-regexp5 CVEs
  10. 210.@perfood/couch-auth5 CVEs
  11. 211.@quasar/app-vite5 CVEs
  12. 212.rendertron5 CVEs
  13. 213.safe-eval5 CVEs
  14. 214.serve5 CVEs
  15. 215.shell-quote5 CVEs
  16. 216.socket.io-parser5 CVEs
  17. 217.tinacms5 CVEs
  18. 218.@tinacms/graphql5 CVEs
  19. 219.toml5 CVEs
  20. 220.total45 CVEs
  21. 221.vditor5 CVEs
  22. 222.vega-functions5 CVEs
  23. 223.@vendure/core5 CVEs
  24. 224.@vitest/browser5 CVEs
  25. 225.xlsx5 CVEs
  26. 226.yarn5 CVEs
  27. 227.@adonisjs/bodyparser4 CVEs
  28. 228.angular-expressions4 CVEs
  29. 229.@apollo/gateway4 CVEs
  30. 230.auth0-lock4 CVEs
  31. 231.aws-cdk-lib4 CVEs
  32. 232.aws-iot-device-sdk-v24 CVEs
  33. 233.@backstage/plugin-auth-backend4 CVEs
  34. 234.@backstage/plugin-techdocs-backend4 CVEs
  35. 235.@better-auth/oauth-provider4 CVEs
  36. 236.body-parser4 CVEs
  37. 237.@clerk/nextjs4 CVEs
  38. 238.code-server4 CVEs
  39. 239.convert-svg-core4 CVEs
  40. 240.@earendil-works/pi-coding-agent4 CVEs
  41. 241.erxes4 CVEs
  42. 242.exifreader4 CVEs
  43. 243.express-cart4 CVEs
  44. 244.@fastify/middie4 CVEs
  45. 245.@fastify/static4 CVEs
  46. 246.@feathersjs/authentication-oauth4 CVEs
  47. 247.@finos/git-proxy4 CVEs
  48. 248.hummus4 CVEs
  49. 249.i18next-http-backend4 CVEs
  50. 250.i18next-http-middleware4 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →