Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2025-32996In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.npm · http-proxy-middleware · fixed in 2.0.8, 3.0.4
- CVE-2025-32997In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.npm · http-proxy-middleware · fixed in 2.0.9, 3.0.5
- CVE-2025-32395Vite has an `server.fs.deny` bypass with an invalid `request-target`npm · vite · fixed in 6.2.6, 6.1.5, 6.0.15 and more
- CVE-2025-32379XSS at ctx.redirect() function in Koajsnpm · koa · fixed in 2.16.1, 3.0.0-alpha.5
- CVE-2025-29189Flowise <= 2.2.3 is vulnerable to SQL Injection.npm · flowise-components · fixed in 2.2.4
- CVE-2025-32020Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in crud-query-parsernpm · crud-query-parser · fixed in 0.1.0
- CVE-2025-32031Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypassnpm · @apollo/gateway · fixed in 2.10.1
- CVE-2025-32030Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansionnpm · @apollo/gateway · fixed in 2.10.1
- CVE-2025-32029ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value Representationnpm · @apeleghq/asn1-der · fixed in 1.0.4
- CVE-2025-32014estree-util-value-to-estree allows prototype pollution in generated ESTreenpm · estree-util-value-to-estree · fixed in 3.3.3
- CVE-2025-31476tarteaucitron.js allows url scheme injection via unfiltered inputsnpm · tarteaucitronjs · fixed in 1.20.1
- CVE-2025-31475tarteaucitron.js allows prototype pollution via custom text injectionnpm · tarteaucitronjs · fixed in 1.20.1
- CVE-2025-31138tarteaucitron.js allows UI manipulation via unrestricted CSS injectionnpm · tarteaucitronjs · fixed in 1.20.1
- CVE-2025-3191All versions of the package react-draft-wysiwyg are vulnerable to Cross-site Scripting (XSS) via the Embedded button which will then result npm · react-draft-wysiwyg
- CVE-2025-3197Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js.npm · expand-object
- CVE-2025-3194Versions of the package bigint-buffer from 0.0.0 are vulnerable to Buffer Overflow in the toBigIntLE() function.npm · bigint-buffer
- CVE-2025-31119CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Frameworknpm · generator-jhipster-entity-audit · fixed in 5.9.1
- CVE-2025-31486Vite allows server.fs.deny to be bypassed with .svg or relative pathsnpm · vite · fixed in 6.2.5, 6.1.4, 6.0.14 and more
- CVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hostsnpm · next · fixed in 12.3.6, 13.5.10, 14.2.26 and more
- CVE-2025-31477Improper Scope Validation in the open Endpoint of tauri-plugin-shellnpm · @tauri-apps/plugin-shell · fixed in 2.2.1
- CVE-2025-31137Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headersnpm · @react-router/express, @remix-run/express · fixed in 7.4.1, 2.16.3
- CVE-2025-29049Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrarynpm · mathlive · fixed in 0.104.0
- CVE-2025-31128gifplayer XSS vulnerabilitynpm · gifplayer · fixed in 0.3.7
- CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` querynpm · vite · fixed in 6.2.4, 6.1.3, 6.0.13 and more
- CVE-2024-38985janryWang products depath v1.0.6 and cool-path v1.1.2 were discovered to contain a prototype pollution via the set() method at setIn (lib/innpm · cool-path, depath
- CVE-2024-38988alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js.npm · @alizeait/unflatto · fixed in 1.0.3
- CVE-2024-57083A prototype pollution in the component Module.mergeObjects (redoc/bundles/redoc.lib.js:2) of redoc <= 2.2.0 allows attackers to cause a Deninpm · redoc · fixed in 2.4.0
- CVE-2024-12905An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Tranpm · tar-fs · fixed in 1.16.4, 2.1.2, 3.0.7
- CVE-2025-27793Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]npm · vega, vega-functions · fixed in 5.32.0, 5.17.0
- CVE-2025-26619Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter`npm · vega, vega-functions · fixed in 5.31.0, 5.16.0