CVE-2016-3956: npm Token Leak in npm
Summary
CVE-2016-3956: npm Token Leak in npm. Affects npm across 2 version ranges.
< 2.15.1
>= 3.0.0, < 3.8.3
Fixed in 2.15.1 or 3.8.3, depending on the release line you run. How to fix ↓
Also tracked for
- npm · Debian:11
The same CVE-2016-3956 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package is a popular package manager for the Node.js ecosystem. It allows developers to easily install, manage, and publish packages for their Node.js projects. The vulnerability in npm allows the bearer token of the logged-in user to be included in every request made by the CLI, even if the request is not directed towards the user's active registry. This token leakage can be exploited by an attacker to compromise the user's token and perform actions on behalf of the user, including publishing new packages.
Vulnerability Detail
The vulnerability arises from the inclusion of the user's bearer token in every request made by the npm CLI. This token can be intercepted by an attacker who sets up an HTTP server to collect tokens. The attacker can then trigger the npm CLI to make a request to their server, compromising the user's token. This compromised token grants the attacker the same privileges as the user, enabling them to perform any action that the user can, such as publishing new packages.
How To Fix
Latest published version: 12.2.1 as of 22 Oct 2026
npm install npm@12.2.1Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.15.12.15.1npm install npm@2.15.1 -
>= 3.0.0, < 3.8.33.8.3npm install npm@3.8.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The npm package is vulnerable to a token leak issue that can be exploited by attackers to compromise user tokens and perform unauthorized actions. It is crucial to update npm to the latest version, revoke tokens, and enable Two-Factor Authentication to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for npm →
FAQ
Versions of npm up to and including 2.15.0 are affected, as well as versions 3.0.0 up to and including 3.8.2.
You can use the Vulert Playground at Vulert Scanner to check if your npm installation is affected by this vulnerability. Simply upload your package-lock.json file and the playground will alert you if any vulnerabilities are found.
With a compromised token, an attacker can perform any action that the user can, including publishing new packages, accessing private packages, and modifying package metadata.
No, updating npm to the latest version is the recommended way to mitigate this vulnerability. Revoke your tokens and enable Two-Factor Authentication for added security.
There are no known public exploits of this vulnerability at this time.
References
Related vulnerabilities
Recent vulnerabilities recorded for npm.
