npm Package Vulnerabilities

All 2,760 JavaScript / Node.js packages with known CVEs, ranked by live CVE volume — 6,242 package-to-CVE mappings with affected ranges and fixed versions. Updated continuously as new vulnerabilities publish.

  1. 1.openclaw530 CVEs
  2. 2.n8n140 CVEs
  3. 3.parse-server117 CVEs
  4. 4.flowise110 CVEs
  5. 5.electron65 CVEs
  6. 6.next56 CVEs
  7. 7.directus55 CVEs
  8. 8.nocodb54 CVEs
  9. 9.hono47 CVEs
  10. 10.vm244 CVEs
  11. 11.axios43 CVEs
  12. 12.ghost38 CVEs
  13. 13.@budibase/server36 CVEs
  14. 14.undici35 CVEs
  15. 15.pnpm28 CVEs
  16. 16.@anthropic-ai/claude-code27 CVEs
  17. 17.dompurify27 CVEs
  18. 18.flowise-components27 CVEs
  19. 19.astro25 CVEs
  20. 20.better-auth22 CVEs
  21. 21.fuxa-server22 CVEs
  22. 22.nuxt22 CVEs
  23. 23.vite22 CVEs
  24. 24.tar21 CVEs
  25. 25.@openzeppelin/contracts19 CVEs
  26. 26.@openzeppelin/contracts-upgradeable19 CVEs
  27. 27.react-router19 CVEs
  28. 28.tinymce18 CVEs
  29. 29.protobufjs17 CVEs
  30. 30.ckeditor416 CVEs
  31. 31.@haxtheweb/haxcms-nodejs16 CVEs
  32. 32.liquidjs16 CVEs
  33. 33.jspdf15 CVEs
  34. 34.sequelize15 CVEs
  35. 35.joplin14 CVEs
  36. 36.mermaid14 CVEs
  37. 37.nodebb14 CVEs
  38. 38.@nyariv/sandboxjs14 CVEs
  39. 39.signalk-server14 CVEs
  40. 40.systeminformation14 CVEs
  41. 41.angular13 CVEs
  42. 42.apostrophe13 CVEs
  43. 43.electerm13 CVEs
  44. 44.next-auth13 CVEs
  45. 45.shescape13 CVEs
  46. 46.@directus/api12 CVEs
  47. 47.@evershop/evershop12 CVEs
  48. 48.fast-xml-parser12 CVEs
  49. 49.handlebars12 CVEs
  50. 50.jsrsasign12 CVEs

Which npm packages run in YOUR stack?

EchelonGraph inventories your dependencies and correlates them against live CVE intelligence — affected ranges, fixed versions, and blast radius in one graph.

Start Free Scan →