npm vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-0775 npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability.High 7 · Jan 22, 2026
• CVE-2023-31999 All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users.High 8.8 · Jul 4, 2023
• CVE-2022-29244 npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie.High 7.5 · Jun 13, 2022
• CVE-2021-39135 `@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guaraHigh 8.2 · Aug 31, 2021
• CVE-2021-39134 `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guaHigh 8.2 · Aug 31, 2021
• CVE-2021-37713 The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabiliHigh 8.2 · Aug 31, 2021
• CVE-2021-37712 The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabiliHigh 8.2 · Aug 31, 2021
• CVE-2021-37701 The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerabilitHigh 8.2 · Aug 31, 2021
• CVE-2021-32804 The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient aHigh 8.2 · Aug 3, 2021
• CVE-2021-32803 The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symHigh 8.2 · Aug 3, 2021
• CVE-2019-16777 Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite.High 7.7 · Dec 12, 2019
• CVE-2019-16776 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.High 7.7 · Dec 12, 2019
• CVE-2019-16775 Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write.High 7.7 · Dec 12, 2019
• CVE-2019-5423 Path traversal vulnerability in http-live-simulator npm package version 1.0.5 allows arbitrary path to be accessed on the file system by a remote attacker.High 7.5 · Apr 3, 2019
• CVE-2018-16202 Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) High 8.6 · Jan 9, 2019
• CVE-2018-16475 A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.High 7.5 · Nov 6, 2018
• CVE-2018-16472 A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are then inherited by alHigh 7.5 · Nov 6, 2018
• CVE-2018-11615 This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1.High 7.5 · Aug 30, 2018