npm Package Vulnerabilities

All 3,017 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 7,316 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw531 CVEs
  2. 2.n8n156 CVEs
  3. 3.parse-server118 CVEs
  4. 4.flowise112 CVEs
  5. 5.electron79 CVEs
  6. 6.vm278 CVEs
  7. 7.ghost70 CVEs
  8. 8.next65 CVEs
  9. 9.directus56 CVEs
  10. 10.axios55 CVEs
  11. 11.undici55 CVEs
  12. 12.nocodb54 CVEs
  13. 13.hono52 CVEs
  14. 14.@budibase/server41 CVEs
  15. 15.apostrophe33 CVEs
  16. 16.node-forge33 CVEs
  17. 17.dompurify32 CVEs
  18. 18.pnpm31 CVEs
  19. 19.@anthropic-ai/claude-code29 CVEs
  20. 20.flowise-components29 CVEs
  21. 21.payload29 CVEs
  22. 22.vite29 CVEs
  23. 23.astro28 CVEs
  24. 24.nodemailer27 CVEs
  25. 25.better-auth26 CVEs
  26. 26.nuxt25 CVEs
  27. 27.@xmldom/xmldom23 CVEs
  28. 28.fuxa-server22 CVEs
  29. 29.tar21 CVEs
  30. 30.9router19 CVEs
  31. 31.liquidjs19 CVEs
  32. 32.@openzeppelin/contracts19 CVEs
  33. 33.react-router19 CVEs
  34. 34.@sveltejs/kit19 CVEs
  35. 35.tinymce19 CVEs
  36. 36.fastify18 CVEs
  37. 37.@openzeppelin/contracts-upgradeable18 CVEs
  38. 38.xmldom18 CVEs
  39. 39.fast-uri17 CVEs
  40. 40.protobufjs17 CVEs
  41. 41.sanitize-html17 CVEs
  42. 42.systeminformation17 CVEs
  43. 43.@backstage/plugin-scaffolder-backend16 CVEs
  44. 44.devalue16 CVEs
  45. 45.@haxtheweb/haxcms-nodejs16 CVEs
  46. 46.sequelize16 CVEs
  47. 47.signalk-server16 CVEs
  48. 48.ckeditor415 CVEs
  49. 49.handlebars15 CVEs
  50. 50.jspdf15 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →