npm
5,670 CVEs tracked since 2010. Since Oct 2021, 8 of them reached CISA KEV.
npm CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-10 | 24 | 0 |
| 2021-11 | 44 | 0 |
| 2021-12 | 26 | 0 |
| 2022-01 | 41 | 0 |
| 2022-02 | 30 | 0 |
| 2022-03 | 48 | 0 |
| 2022-04 | 29 | 0 |
| 2022-05 | 44 | 0 |
| 2022-06 | 55 | 0 |
| 2022-07 | 49 | 0 |
| 2022-08 | 53 | 0 |
| 2022-09 | 43 | 0 |
| 2022-10 | 33 | 0 |
| 2022-11 | 35 | 1 |
| 2022-12 | 48 | 0 |
| 2023-01 | 47 | 0 |
| 2023-02 | 45 | 0 |
| 2023-03 | no snapshot | |
| 2023-04 | 37 | 0 |
| 2023-05 | 27 | 0 |
| 2023-06 | 30 | 0 |
| 2023-07 | 28 | 0 |
| 2023-08 | 36 | 0 |
| 2023-09 | 29 | 2 |
| 2023-10 | 27 | 0 |
| 2023-11 | 23 | 0 |
| 2023-12 | 37 | 0 |
| 2024-01 | 33 | 0 |
| 2024-02 | 29 | 0 |
| 2024-03 | 43 | 0 |
| 2024-04 | 32 | 0 |
| 2024-05 | 40 | 0 |
| 2024-06 | 33 | 0 |
| 2024-07 | 47 | 0 |
| 2024-08 | 32 | 0 |
| 2024-09 | 47 | 0 |
| 2024-10 | 53 | 0 |
| 2024-11 | 22 | 0 |
| 2024-12 | 22 | 0 |
| 2025-01 | 23 | 0 |
| 2025-02 | 47 | 0 |
| 2025-03 | 52 | 1 |
| 2025-04 | 47 | 0 |
| 2025-05 | 32 | 0 |
| 2025-06 | 34 | 0 |
| 2025-07 | 59 | 1 |
| 2025-08 | 51 | 0 |
| 2025-09 | 100 | 0 |
| 2025-10 | 55 | 0 |
| 2025-11 | 57 | 1 |
| 2025-12 | 75 | 2 |
| 2026-01 | 142 | 0 |
| 2026-02 | 227 | 0 |
| 2026-03 | 562 | 0 |
| 2026-04 | 309 | 0 |
| 2026-05 | 86 | 0 |
| 2026-06 | 89 | 0 |
| 2026-07 | 158 | 0 |
| 2026-08 | 33 | 0 |
| 2026-09 | 57 | 0 |
| 2026-10 | 54 | 0 |
| 2026-11 | 0 |
Products
The products that kept showing up in npm's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting npm.
- GHSA-j656-3hf2-fvjcDBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation—
- GHSA-7wpf-ch8f-5f4xsignalk-server has SSRF via absolute signalk.appIcon URL in the app store icon fetcher—
- GHSA-4xm8-rg9h-jhq2Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution—
- GHSA-w9x9-j56r-h98r@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy—
- GHSA-c33x-vcv4-vg3gCedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence—
- GHSA-jf75-q64q-g65rWaline login accepts a non-string email as a match-all MongoDB query—
- GHSA-4mfg-r38w-w8fgmcp-sanitizer: URL sanitizer allows localhost/IPv6 loopback SSRF bypass via explicit port or bracketed IPv6—
- GHSA-7w82-6f9j-v9jpmcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths—
- GHSA-f897-62hf-6gxqMCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length—
- GHSA-44jh-23m7-hpcf@better-auth/drizzle-adapter: Concurrent requests can exceed rate limits on PostgreSQL—
- GHSA-r4xp-prcw-77qfbetter-auth: OAuth Proxy lets an attacker sign in as another user—
- GHSA-4ffr-jq9g-5ffxNodemailer: Quadratic backtracking in SMTP AUTH mechanism detection regexes allows pre-auth remote denial of service—
- GHSA-g73g-hqqh-jr95Nodemailer: RFC 5322 comment inside an angle-bracket address is never stripped—
- GHSA-4g23-2xm8-66gcNodemailer: Quadratic (O(n^2)) SMTP client reply parsing lets a malicious server or MITM cause a pre-auth remote denial of service—
- GHSA-q84f-53jg-9ppmbetter-auth: Device login approval does not show the requesting client or permissions—
The record
- Peak rank
- #1 in Mar 2026
- Busiest month shown
- Mar 2026, 562 CVEs
- Months with a KEV entry
- 6 since Oct 2021
- Monthly snapshots
- 125 since 2010