CVE Tools
Track your stack

npm

5,579 CVEs across 124 months on the top 200 list since Jun 2010. Peak rank #1 in 4 months, last Mar 2026. 10 of them are now in CISA KEV.

npm CVEs per month since Jun 2010

Oct 2021 to Sep 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 562, Mar 2026
Oct 2021: 24 CVEs · 8 critical · 0 now in CISA KEV · rank #31 · mostly Aaptjs, Jquery-ui, KindeditorNov 2021: 44 CVEs · 7 critical · 0 now in CISA KEV · rank #15 · mostly Aws-iot-device-sdk-v2, Nodebb, ApostropheDec 2021: 26 CVEs · 5 critical · 0 now in CISA KEV · rank #26 · mostly Jsx-slack, @backstage/plugin-scaffolder-backend, CombJan 2022: 41 CVEs · 5 critical · 0 now in CISA KEV · rank #25 · mostly Node-forge, Marked, ShelljsFeb 2022: 30 CVEs · 7 critical · 0 now in CISA KEV · rank #28 · mostly Url-parse, Karma, Fastify-multipartMar 2022: 48 CVEs · 8 critical · 0 now in CISA KEV · rank #20 · mostly Node-forge, Node-ipc, VditorApr 2022: 29 CVEs · 9 critical · 0 now in CISA KEV · rank #24 · mostly Fullpage.js, Ghost, UrijsMay 2022: 44 CVEs · 5 critical · 0 now in CISA KEV · rank #19 · mostly Strapi, @strapi/strapi, ConvictJun 2022: 55 CVEs · 8 critical · 0 now in CISA KEV · rank #14 · mostly Parse-url, Nocodb, Parse-serverJul 2022: 49 CVEs · 9 critical · 0 now in CISA KEV · rank #18 · mostly Undici, Llhttp, @openzeppelin/contractsAug 2022: 53 CVEs · 14 critical · 0 now in CISA KEV · rank #16 · mostly @openzeppelin/contracts, @openzeppelin/contracts-upgradeable, RanetoSep 2022: 43 CVEs · 10 critical · 0 now in CISA KEV · rank #21 · mostly Steal, Matrix-js-sdk, Parse-serverOct 2022: 33 CVEs · 13 critical · 0 now in CISA KEV · rank #32 · mostly Browserify-shim, Feathers-sequelize, Loader-utilsNov 2022: 35 CVEs · 4 critical · 1 now in CISA KEV · rank #20 · mostly Hummus, Muhammara, Sweetalert2Dec 2022: 48 CVEs · 7 critical · 0 now in CISA KEV · rank #23 · mostly Jsonwebtoken, Nadesiko3, @cubejs-backend/api-gatewayJan 2023: 47 CVEs · 2 critical · 0 now in CISA KEV · rank #16 · mostly Papaparse, Serve-lite, @builder.io/qwikFeb 2023: 45 CVEs · 4 critical · 0 now in CISA KEV · rank #17 · mostly Sequelize, @sequelize/core, UndiciMar 2023: not on the top 200 that monthApr 2023: 37 CVEs · 9 critical · 0 now in CISA KEV · rank #22 · mostly VM2, @strapi/plugin-users-permissions, @openzeppelin/contracts-upgradeableMay 2023: 27 CVEs · 4 critical · 0 now in CISA KEV · rank #28 · mostly N8N, VM2, GhostJun 2023: 30 CVEs · 3 critical · 0 now in CISA KEV · rank #29 · mostly @openzeppelin/contracts, @openzeppelin/contracts-upgradeable, JoplinJul 2023: 28 CVEs · 6 critical · 0 now in CISA KEV · rank #32 · mostly @fastify/oauth2, Uptime-kuma, NodebbAug 2023: 36 CVEs · 4 critical · 0 now in CISA KEV · rank #25 · mostly @excalidraw/excalidraw, Matrix-appservice-irc, Find-execSep 2023: 29 CVEs · 3 critical · 2 now in CISA KEV · rank #31 · mostly Electron, Fuxa-server, @frangoteam/fuxaOct 2023: 27 CVEs · 5 critical · 0 now in CISA KEV · rank #30 · mostly @vrite/sdk, Tinymce, Crypto-esNov 2023: 23 CVEs · 2 critical · 0 now in CISA KEV · rank #29 · mostly Ckeditor4, Openmct, BootboxDec 2023: 37 CVEs · 3 critical · 0 now in CISA KEV · rank #21 · mostly @evershop/evershop, Uptime-kuma, Nuxt-api-partyJan 2024: 33 CVEs · 6 critical · 0 now in CISA KEV · rank #30 · mostly Tinymce, Meshcentral, @evershop/evershopFeb 2024: 29 CVEs · 4 critical · 0 now in CISA KEV · rank #29 · mostly Stimulsoft-dashboards-js, Undici, Ckeditor4Mar 2024: 43 CVEs · 7 critical · 0 now in CISA KEV · rank #23 · mostly Directus, Katex, RsshubApr 2024: 32 CVEs · 5 critical · 0 now in CISA KEV · rank #31 · mostly Mysql2, Undici, PsitransferMay 2024: 40 CVEs · 4 critical · 0 now in CISA KEV · rank #36 · mostly Nocodb, Directus, Libxmljs2Jun 2024: 33 CVEs · 6 critical · 0 now in CISA KEV · rank #23 · mostly @janhq/core, Lunary, TinymceJul 2024: 47 CVEs · 7 critical · 0 now in CISA KEV · rank #21 · mostly Flowise, Bootstrap, DirectusAug 2024: 32 CVEs · 4 critical · 0 now in CISA KEV · rank #28 · mostly Directus, Elliptic, FlowiseSep 2024: 47 CVEs · 2 critical · 0 now in CISA KEV · rank #15 · mostly Lunary, Mattermost-desktop, AgnaiOct 2024: 53 CVEs · 9 critical · 0 now in CISA KEV · rank #19 · mostly @saltcorn/server, Dompurify, @openc3/tool-commonNov 2024: 22 CVEs · 0 critical · 0 now in CISA KEV · rank #44 · mostly @sveltejs/kit, Vue-i18n, Petite-vue-i18nDec 2024: 22 CVEs · 4 critical · 0 now in CISA KEV · rank #31 · mostly Directus, Astro, Cookie-encrypterJan 2025: 23 CVEs · 1 critical · 0 now in CISA KEV · rank #33 · mostly Directus, @lodestar/reqresp, @fastify/multipartFeb 2025: 47 CVEs · 5 critical · 0 now in CISA KEV · rank #17 · mostly Mongosh, Better-auth, @ckeditor/ckeditor5-real-time-collaborationMar 2025: 52 CVEs · 7 critical · 1 now in CISA KEV · rank #19 · mostly Directus, Open-webui, FlowiseApr 2025: 47 CVEs · 2 critical · 0 now in CISA KEV · rank #20 · mostly Tarteaucitronjs, React-router, MathliveMay 2025: 32 CVEs · 1 critical · 0 now in CISA KEV · rank #36 · mostly @cloudflare/workers-oauth-provider, Passport-wsfed-saml2, Mcp-markdownify-serverJun 2025: 34 CVEs · 7 critical · 0 now in CISA KEV · rank #29 · mostly Erxes, Webpack-dev-server, @haxtheweb/haxcms-nodejsJul 2025: 59 CVEs · 4 critical · 1 now in CISA KEV · rank #23 · mostly @haxtheweb/haxcms-nodejs, Directus, @finos/git-proxyAug 2025: 51 CVEs · 9 critical · 0 now in CISA KEV · rank #20 · mostly @anthropic-ai/claude-code, Next, FlowiseSep 2025: 100 CVEs · 12 critical · 0 now in CISA KEV · rank #12 · mostly Flowise, @anthropic-ai/claude-code, Express-xss-sanitizerOct 2025: 55 CVEs · 4 critical · 0 now in CISA KEV · rank #19 · mostly Flowise, @strapi/core, @anthropic-ai/claude-codeNov 2025: 57 CVEs · 8 critical · 1 now in CISA KEV · rank #10 · mostly Astro, Directus, Node-forgeDec 2025: 75 CVEs · 9 critical · 2 now in CISA KEV · rank #11 · mostly N8N, @vitejs/plugin-rsc, React-server-dom-webpackJan 2026: 142 CVEs · 20 critical · 0 now in CISA KEV · rank #3 · mostly Pnpm, Hono, RenovateFeb 2026: 227 CVEs · 48 critical · 0 now in CISA KEV · rank #1 · mostly Openclaw, N8N, Fuxa-serverMar 2026: 562 CVEs · 29 critical · 0 now in CISA KEV · rank #1 · mostly Openclaw, Parse-server, NocodbApr 2026: 309 CVEs · 0 critical · 0 now in CISA KEV · rank #2 · mostly Openclaw, Flowise, Flowise-componentsMay 2026: 86 CVEs · 0 critical · 0 now in CISA KEV · rank #8 · mostly Openclaw, Flowise, @hulumi/policiesJun 2026: 89 CVEs · 0 critical · 0 now in CISA KEV · rank #10 · mostly Openclaw, Praisonai, Network-aiJul 2026: 158 CVEs · 0 critical · 0 now in CISA KEV · rank #8 · mostly N8N, Openclaw, @budibase/serverAug 2026: 33 CVEs · 0 critical · 0 now in CISA KEV · rank #43 · mostly Axios, Flowise, NuxtSep 2026 so far: 20 CVEs · 0 critical · 0 now in CISA KEV · rank #53 · mostly Nodemailer, Pnpm, @openclaw/feishu

In the lens

The products that kept showing up in npm's monthly top three from Oct 2021 to Sep 2026. Move the lens and the list follows.

  1. Openclaw7036 months
  2. Flowise749 months
  3. N8N664 months
  4. Parse-server383 months
  5. Directus289 months
  6. @budibase/server191 month
  7. Nocodb173 months
  8. Fuxa-server152 months
  9. Flowise-components111 month
  10. Node-forge103 months

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#1 in 4 months, last Mar 2026
Busiest month
Sep 2020, 644 CVEs
Months with a KEV entry
8 of 124 on the list
On the top 200 list
124 of 196 monthly snapshots

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store