Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-11831Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptnpm · serialize-javascript · fixed in 6.0.2
- CVE-2024-57177A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2.npm · @perfood/couch-auth
- CVE-2025-24981Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdcnpm · @nuxtjs/mdc · fixed in 0.13.3
- CVE-2024-57066A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplyingnpm · @ndhoule/defaults
- CVE-2024-57068A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS)npm · @tanstack/form-core · fixed in 0.42.1
- CVE-2024-57072A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS)npm · module-from-string
- CVE-2024-57075A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a cnpm · eazy-logger · fixed in 4.1.0
- CVE-2024-57077The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend.npm · utils-extend
- CVE-2024-57079A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplyinnpm · @zag-js/core · fixed in 0.82.2
- CVE-2024-57080A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a cnpm · vxe-table
- CVE-2024-57082A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via snpm · @rpldy/uploader · fixed in 1.9.1
- CVE-2024-57085A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via suppnpm · @stryker-mutator/util · fixed in 8.7.1
- CVE-2024-57086A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoSnpm · node-opcua-alarm-condition · fixed in 2.137.0
- CVE-2025-24963Browser mode serves arbitrary files in vitestnpm · @vitest/browser · fixed in 2.1.9, 3.0.4
- CVE-2025-24964Remote Code Execution when accessing a malicious website while Vitest API server is listeningnpm · vitest · fixed in 1.6.1, 2.1.9, 3.0.5
- CVE-2025-24959Environment Variable Injection for dotenv API in zxnpm · zx · fixed in 8.3.2
- CVE-2024-53615A command injection vulnerability in the video thumbnail rendering component of Karl Ward's files.gallery v0.3.0 through 0.11.0 allows remotnpm · files.photo.gallery
- CVE-2025-24791snowflake-connector-nodejs has incorrect validation of temporary credential cache file permissionsnpm · snowflake-sdk · fixed in 2.0.2
- CVE-2025-24361Opening a malicious website while running a Nuxt dev server could allow read-only access to codenpm · @nuxt/rspack-builder, @nuxt/webpack-builder · fixed in 3.15.3
- CVE-2025-24360Opening a malicious website while running a Nuxt dev server could allow read-only access to codenpm · @nuxt/vite-builder · fixed in 3.15.3
- CVE-2024-57041A persistent cross-site scripting (XSS) vulnerability in NodeBB v3.11.0 allows remote attackers to store arbitrary code in the 'about me' senpm · nodebb · fixed in 3.11.1
- CVE-2025-24353Directus privilege escalation vulnerability using Share featurenpm · @directus/app, directus · fixed in 13.3.1, 11.2.0
- CVE-2025-24033@fastify/multipart vulnerable to unlimited consumption of resourcesnpm · @fastify/multipart · fixed in 8.3.1, 9.0.3
- CVE-2024-57556Cross Site Scripting vulnerability in nbubna store v.2.14.2 and before allows a remote attacker to execute arbitrary code via the store.deepnpm · store2 · fixed in 2.14.4
- CVE-2025-22150Undici Uses Insufficiently Random Valuesnpm · undici · fixed in 5.28.5, 6.21.1, 7.2.3
- CVE-2025-24012Umbraco Backoffice Components Have XSS/HTML Injection Vulnerabilitynpm · @umbraco-cms/backoffice · fixed in 14.3.2, 15.1.2
- CVE-2025-23221Fedify has an Infinite loop and Blind SSRF found inside the Webfinger mechanismnpm · @fedify/fedify · fixed in 1.0.14, 1.1.11, 1.2.11 and more
- CVE-2025-24010Vite allows any websites to send any requests to the development server and read the responsenpm · vite · fixed in 6.0.9, 5.4.12, 4.5.6
- CVE-2025-23207\htmlData does not validate attribute names in KaTeXnpm · katex · fixed in 0.16.21
- CVE-2025-23206IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdknpm · aws-cdk-lib · fixed in 2.177.0