npm Package Vulnerabilities

All 2,874 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 6,722 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw530 CVEs
  2. 2.n8n157 CVEs
  3. 3.parse-server117 CVEs
  4. 4.flowise110 CVEs
  5. 5.vm272 CVEs
  6. 6.electron71 CVEs
  7. 7.next57 CVEs
  8. 8.directus56 CVEs
  9. 9.axios55 CVEs
  10. 10.nocodb54 CVEs
  11. 11.hono51 CVEs
  12. 12.undici46 CVEs
  13. 13.@budibase/server41 CVEs
  14. 14.ghost38 CVEs
  15. 15.pnpm31 CVEs
  16. 16.@anthropic-ai/claude-code27 CVEs
  17. 17.dompurify27 CVEs
  18. 18.flowise-components27 CVEs
  19. 19.astro26 CVEs
  20. 20.@xmldom/xmldom23 CVEs
  21. 21.better-auth22 CVEs
  22. 22.fuxa-server22 CVEs
  23. 23.nuxt22 CVEs
  24. 24.vite22 CVEs
  25. 25.tar21 CVEs
  26. 26.nodemailer20 CVEs
  27. 27.9router19 CVEs
  28. 28.@openzeppelin/contracts19 CVEs
  29. 29.@openzeppelin/contracts-upgradeable19 CVEs
  30. 30.react-router19 CVEs
  31. 31.liquidjs18 CVEs
  32. 32.tinymce18 CVEs
  33. 33.xmldom18 CVEs
  34. 34.fastify17 CVEs
  35. 35.protobufjs17 CVEs
  36. 36.@sveltejs/kit17 CVEs
  37. 37.ckeditor416 CVEs
  38. 38.@haxtheweb/haxcms-nodejs16 CVEs
  39. 39.apostrophe15 CVEs
  40. 40.jspdf15 CVEs
  41. 41.sequelize15 CVEs
  42. 42.joplin14 CVEs
  43. 43.mermaid14 CVEs
  44. 44.multer14 CVEs
  45. 45.nodebb14 CVEs
  46. 46.@nyariv/sandboxjs14 CVEs
  47. 47.signalk-server14 CVEs
  48. 48.systeminformation14 CVEs
  49. 49.angular13 CVEs
  50. 50.electerm13 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Book a Demo →