npm
12 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for npm, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
npm CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 12 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High8
- Medium2
- Low1
Latest CVEs
The 12 most recently published vulnerabilities affecting npm.
- CVE-2026-0775npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability7.0
- CVE-2022-29244npm packing does not respect root-level ignore files in workspaces7.5
- CVE-2021-43616The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with t...9.0
- CVE-2021-35225Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.55.0
- CVE-2021-26700Visual Studio Code npm-script Extension Remote Code Execution Vulnerability7.8
- CVE-2020-15095Sensitive information exposure through logs in npm cli4.4
- CVE-2019-16777Arbitrary File Overwrite in npm CLI7.7
- CVE-2019-16776Unauthorized File Access in npm CLI before before version 6.13.37.7
- CVE-2019-16775Unauthorized File Access in npm CLI before before version 6.13.37.7
- CVE-2018-7408An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's ...7.8
- CVE-2016-3956The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used in Node.js 0.10 before 0.10.44, 0.12 before 0.12.13, 4 before 4.4.2, and 5 before 5.10.0, includes bearer tokens with arbitrary requests, ...7.5
- CVE-2013-4116lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking...3.3
Product grouping is registry-driven, with AI assist and human review. How it works