npm CVE feed and alerts

Every new CVE and security advisory affecting npm packages, merged from the CVE List, GitHub, OSV, NVD and CISA KEV into one entry each, with severity, exploitation status and fixed versions. New entries appear within minutes of their source. The feeds are free and need no API key; the newest 200 are listed below.

Critical: 17
High: 88
On CISA KEV: 1

Of the newest 199

Show all 199 entriesShow fewer entries

Frequently asked questions

What are the latest npm packages CVEs?

The newest are CVE-2026-128065 (@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied); CVE-2026-126367 (@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation); CVE-2026-126363 (Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js).

Are any npm packages CVEs being exploited?

1 of the 199 newest npm packages vulnerabilities are on CISA's Known Exploited Vulnerabilities list: CVE-2025-55182.

How many critical npm packages CVEs are there?

17 of the 199 newest are rated critical (CVSS 9.0 or higher, or rated critical by their source when they have no score): CVE-2026-126187, CVE-2026-125120, CVE-2026-123807, CVE-2026-46350, CVE-2026-107846 and more.

How do I get alerts for new npm packages CVEs?

Subscribe to this page's RSS, Atom or JSON feed, or connect a coding agent to the cve.now MCP server. Each new entry appears within minutes of its source.

Is there an RSS feed of npm CVEs?

Yes: https://cve.now/feed?ecosystem=npm. Add format=atom or format=json for Atom or JSON Feed. It is free and needs no account or API key.

How do I get npm CVEs in Slack or by email?

In Slack, run /feed subscribe https://cve.now/feed?ecosystem=npm. For email, give the RSS URL to any RSS-to-email service.

npm CVE feed and alerts

Get alerts for new npm CVEs

Frequently asked questions