Vulnerability Database · Ecosystem

npm vulnerabilities

npm is covered by 230,688 vulnerabilities in the Vulert Vulnerability Database, each with the severity, affected versions, workaround and the fix for the version you actually run.

Search all 230,688 vulnerabilities Malicious packages in npm Critical vulnerabilities only

Vulnerabilities recorded: 230,688
Critical: 224,190
High: 3,116
Medium / Low: 2,857 / 522
Unrated: 0
Last database update: 22/Oct/2026

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

Scan your app free →

01 Severity in npm

How the vulnerabilities split

Critical 224,190
High 3,116
Medium 2,857
Low 522
Unrated 0

Totals add up to the 230,688 vulnerabilities Vulert records for npm, including entries with no severity published yet.

Other ways into the data

02 Most recent critical

Newest critical npm vulnerabilities

See all critical npm vulnerabilities →

9.5 CVSS

GHSA-673q-mjm6-r5xr: Unauthenticated remote code execution in Next.js cache functions

next · npm · disclosed 22 Oct 2026

16.4.1 fixed version
9.2 CVSS

GHSA-cg2g-xh64-v4q7: DOMPurify template-expression bypass in attached shadow roots

dompurify · npm · disclosed 22 Oct 2026

3.4.17 fixed version
9.1 CVSS

CVE-2026-114139: Middleware bypass in @sentry/nextjs tunnel routes

@sentry/nextjs · npm · disclosed 22 Oct 2026

9.47.2 fixed version

03 Related ecosystems

Other platforms in this database

Debian 106,974 Ubuntu 50,092 PyPI 26,494 Red Hat 24,060 Linux 15,912 Bitnami 9,947 Go 9,914 Alpine 8,588 Packagist 7,347 Maven 7,152

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

npm and the database

How many npm vulnerabilities does Vulert track?

npm is covered by 230,688 vulnerabilities, each with the severity, affected versions, workaround and fix where one exists.

How do I fix a vulnerability in npm?

Open the vulnerability for the package and version you run. It lists the vulnerable range, the fixed version to move to, and a workaround when no fix has been published yet.

Does Vulert monitor npm dependencies continuously?

Yes. Upload the manifest or SBOM for your application and Vulert keeps tracking those packages, alerting you when a new vulnerability affects a version you actually use.