npm Package Vulnerabilities

All 2,689 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 5,615 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw455 CVEs
  2. 2.n8n105 CVEs
  3. 3.flowise79 CVEs
  4. 4.parse-server60 CVEs
  5. 5.directus55 CVEs
  6. 6.next51 CVEs
  7. 7.electron49 CVEs
  8. 8.nocodb44 CVEs
  9. 9.vm241 CVEs
  10. 10.hono39 CVEs
  11. 11.axios33 CVEs
  12. 12.pnpm28 CVEs
  13. 13.undici27 CVEs
  14. 14.@anthropic-ai/claude-code25 CVEs
  15. 15.astro22 CVEs
  16. 16.fuxa-server22 CVEs
  17. 17.vite22 CVEs
  18. 18.ghost20 CVEs
  19. 19.@budibase/server19 CVEs
  20. 20.@openzeppelin/contracts19 CVEs
  21. 21.@openzeppelin/contracts-upgradeable19 CVEs
  22. 22.tar18 CVEs
  23. 23.tinymce18 CVEs
  24. 24.protobufjs17 CVEs
  25. 25.ckeditor416 CVEs
  26. 26.dompurify16 CVEs
  27. 27.flowise-components16 CVEs
  28. 28.@haxtheweb/haxcms-nodejs16 CVEs
  29. 29.jspdf15 CVEs
  30. 30.nuxt15 CVEs
  31. 31.joplin14 CVEs
  32. 32.nodebb14 CVEs
  33. 33.react-router14 CVEs
  34. 34.sequelize14 CVEs
  35. 35.signalk-server14 CVEs
  36. 36.systeminformation14 CVEs
  37. 37.angular13 CVEs
  38. 38.electerm13 CVEs
  39. 39.liquidjs13 CVEs
  40. 40.@directus/api12 CVEs
  41. 41.@evershop/evershop12 CVEs
  42. 42.jsrsasign12 CVEs
  43. 43.matrix-js-sdk12 CVEs
  44. 44.node-forge12 CVEs
  45. 45.@nyariv/sandboxjs12 CVEs
  46. 46.strapi12 CVEs
  47. 47.better-auth11 CVEs
  48. 48.handlebars11 CVEs
  49. 49.@lobehub/chat11 CVEs
  50. 50.marked11 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Start Free Scan →