Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-5896tarojs taro index.js redosnpm · taro-css-to-react-native · fixed in 4.1.2
- CVE-2025-5891Unitech pm2 Config.js redosnpm · pm2 · fixed in 7.0.0
- CVE-2025-5889juliangruber brace-expansion index.js expand redosnpm · brace-expansion · fixed in 2.0.2, 1.1.12, 3.0.1 and more
- CVE-2025-45001react-native-keys 0.7.11 is vulnerable to sensitive information disclosure (remote) as encryption cipher and Base64 chunks are stored as planpm · react-native-keys
- CVE-2025-48947NextJS-Auth0 SDK Vulnerable to CDN Caching of Session Cookiesnpm · @auth0/nextjs-auth0 · fixed in 4.6.1
- CVE-2025-2336AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'npm · angular-sanitize
- CVE-2025-49223billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to executenpm · billboard.js · fixed in 3.15.1
- CVE-2025-48997Multer vulnerable to Denial of Service via unhandled exceptionnpm · multer · fixed in 2.0.1
- CVE-2025-30360webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browsernpm · webpack-dev-server · fixed in 5.2.1
- CVE-2025-30359webpack-dev-server users' source code may be stolen when they access a malicious web sitenpm · webpack-dev-server · fixed in 5.2.1
- CVE-2025-48996Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpointnpm · @haxtheweb/open-apis
- CVE-2025-48387tar-fs has issue where extract can write outside the specified dir with a specific tarballnpm · tar-fs · fixed in 1.16.5, 2.1.3, 3.0.9
- CVE-2025-48068Information exposure in Next.js dev server due to lack of origin verificationnpm · next · fixed in 15.2.2, 14.2.30
- CVE-2024-52588Strapi allows Server-Side Request Forgery in Webhook functionnpm · @strapi/admin · fixed in 4.25.2
- CVE-2025-5276Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the Markdownify.get() fnpm · mcp-markdownify-server
- CVE-2025-5273Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to External Parties via the genpm · mcp-markdownify-server
- CVE-2025-48370auth-js Vulnerable to Insecure Path Routing from Malformed User Inputnpm · @supabase/auth-js · fixed in 2.70.0
- CVE-2025-48054Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')npm · radashi · fixed in 12.5.1
- CVE-2018-25110Regular Expression Denial of Service (ReDoS) in markedjs/markednpm · marked · fixed in 0.3.17
- CVE-2025-47949samlify SAML Signature Wrapping attacknpm · samlify · fixed in 2.10.0
- CVE-2025-47944Multer vulnerable to Denial of Service from maliciously crafted requestsnpm · multer · fixed in 2.0.0
- CVE-2025-47935Multer vulnerable to Denial of Service via memory leaks from unclosed streamsnpm · multer · fixed in 2.0.0
- CVE-2025-47934OpenPGP.js's message signature verification can be spoofednpm · openpgp · fixed in 5.11.3, 6.1.1
- CVE-2025-47948Cocotais Bot has builtin .echo command injectionnpm · cocotais-bot · fixed in 1.6.2
- CVE-2025-4759Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribunpm · lockfile-lint-api · fixed in 5.9.2
- CVE-2025-4727Meteor livedata_server.js Object.assign redosnpm · meteor
- CVE-2025-47279undici Denial of Service attack via bad certificate datanpm · undici · fixed in 5.29.0, 6.21.2, 7.5.0
- CVE-2025-1647XSS in Bootstrap title attribute for Tooltip and Popovernpm · bootstrap
- CVE-2025-32421Next.js Race Condition to Cache Poisoningnpm · next · fixed in 14.2.24, 15.1.6
- CVE-2025-47204An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2.npm · bootstrap-multiselect · fixed in 2.0.0