Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2026-54663swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`npm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54662swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client templatenpm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-54660swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`npm · swagger-typescript-api · fixed in 13.12.2
- CVE-2026-67214nanoid Infinite Loop via Negative Size in non-secure modulenpm · nanoid · fixed in 3.3.16, 5.1.16
- CVE-2026-67213nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandomnpm · nanoid · fixed in 3.3.18, 5.1.6
- CVE-2026-54658@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL executionnpm · @hypequery/clickhouse · fixed in 2.5.1
- CVE-2026-47219find-my-way is Vulnerable to DDoS with HTTP2npm · find-my-way · fixed in 9.7.0
- CVE-2026-54609QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwardingnpm · qti-neon
- CVE-2026-54545@wakaru/cli arbitrary file write during bundle unpacknpm · @wakaru/cli · fixed in 1.4.0
- CVE-2026-53669React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)npm · react-router · fixed in 7.18.0
- CVE-2026-55685React Router: Unauthenticated Denial of Service via Inefficient Route Matchingnpm · react-router · fixed in 7.18.0
- CVE-2026-53668React Router: Open redirect can lead to XSSnpm · react-router, react-router-dom · fixed in 7.13.0, 6.30.6
- CVE-2026-53667React Router: Cross-site Scripting is Possible due to Missing RSCErrorHandler Protocol Validation (Incomplete fix for CVE-2026-53667)npm · react-router · fixed in 7.18.0
- CVE-2026-53666React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydrationnpm · react-router · fixed in 7.18.0
- CVE-2026-59730@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectnpm · @astrojs/node · fixed in 11.0.2
- CVE-2026-59728@astrojs/rss: XML Injection via Unescaped RSS Feed Fieldsnpm · @astrojs/rss · fixed in 4.0.19
- CVE-2026-59727Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islandsnpm · astro · fixed in 7.0.4
- CVE-2026-59729Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)npm · astro · fixed in 7.0.6
- CVE-2026-64649Next.js: Server-Side Request Forgery in Server Actions on Custom Serversnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64648Next.js: Response Body Cache Confusion for Requests Containing Bodiesnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64647Next.js: Response Body Cache Confusion with Invalid UTF-8 Request Bodiesnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64646Next.js: Unbounded Server Action payload in Edge runtimenpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-48051Papra: SSRF via HTTP redirect bypass in webhook deliverynpm · @papra/webhooks · fixed in 0.3.3
- CVE-2026-64644Next.js: Denial of Service in the Image Optimization API using SVGsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64643Next.js: Unauthenticated Disclosure of Internal Server Function endpointsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64642Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single localenpm · next · fixed in 16.2.11
- CVE-2026-64641Next.js: Denial of Service in App Router using Server Actionsnpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-64645Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnamenpm · next · fixed in 15.5.21, 16.2.11
- CVE-2026-45623PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsnpm · postcss · fixed in 8.5.12
- CVE-2026-54272ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checksnpm · ip-address · fixed in 10.2.1