Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
npm
Package ecosystem npm. A cumulative reference aggregating every published CVE with an advisory in this registry; not a page of record.
Totals
| CVEs all-time | CVEs YTD | Packages affected |
|---|---|---|
| 81 | 78 | 30 |
Monthly trend
▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▁▂▂▃▅█
2025-11 1 · 2025-12 0 · 2026-01 0 · 2026-02 0 · 2026-03 0 · 2026-04 0 · 2026-05 2 · 2026-06 6 · 2026-07 3 · 2026-08 12 · 2026-09 19 · 2026-10 36
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2025-11953 | 9.8 | 99.8 | KEV | Command injection in React Native Community CLI allows remote attackers to perform remo… |
| CVE-2026-110645 | 9.3 | 88.1 | — | Video-stitch before 2.0.0-beta.1 OS Command Injection via concat() and cut() |
| CVE-2020-37282 | 9.3 | 87.3 | — | office-converter through 1.0.2 OS Command Injection via fileName in generatePdf |
| CVE-2026-110638 | 9.3 | 85.8 | — | doc-recog through 1.1.6 OS Command Injection via DocData._readPDF File Path |
| CVE-2026-110639 | 9.3 | 85.8 | — | @mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir |
| CVE-2026-110640 | 9.3 | 85.8 | — | Whisper-node through 1.1.1 OS Command Injection via filePath and language |
| CVE-2026-110644 | 9.3 | 85.8 | — | nodejs-whisper through 0.3.1 OS Command Injection via convertToWavType |
| CVE-2026-110643 | 9.3 | 85.3 | — | transcribe2texts through 1.0.6 OS Command Injection via transcribeAudio audioPath |
| CVE-2026-110635 | 9.3 | 84.6 | — | webp-converter before 3.0.0 OS Command Injection via File Names and Options |
| CVE-2026-110649 | 9.3 | 84.6 | — | Stills before 25.24.2 OS Command Injection via Media File Names |
| CVE-2026-110641 | 8.7 | 84.6 | — | @runnerty/executor-decompress through 3.1.1 OS Command Injection via Archive File Name |
| CVE-2026-110634 | 9.3 | 83.4 | — | git-diff before 2.0.7 OS Command Injection via gitDiff Input Strings |
| CVE-2026-107703 | 9.3 | 78.7 | — | @enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo |
| CVE-2026-107699 | 9.3 | 73.3 | — | ppt2png through 0.0.6 OS Command Injection via input and output paths |
| CVE-2026-110637 | 8.5 | 66.2 | — | buildebooks before 0.2.2 OS Command Injection via kindlegen EPUB File Name |
| CVE-2026-110648 | 8.5 | 66.2 | — | @offactory/compress-fonts before 1.1.1 OS Command Injection via Font File Names |
| CVE-2026-110647 | 8.5 | 63.3 | — | Turnpress through 0.4.2 OS Command Injection via Crafted .docx File Names |
| CVE-2026-55968 | 8.7 | 63.1 | — | Apache Thrift: Node.js quadratic-time DoS in server receive transports |
| CVE-2026-102437 | 7.8 | 61.9 | — | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injectio… |
| CVE-2024-34394 | 8.1 | 61.8 | — | libxmljs2 namespaces type confusion RCE |
Most-affected packages
| Package | CVEs |
|---|---|
| thrift | 7 |
| @neo4j/graphql | 4 |
| exceljs | 4 |
| qs | 3 |
| shell-quote | 3 |
| snowflake-sdk | 3 |
| adm-zip | 2 |
| brace-expansion | 2 |
| libxmljs2 | 2 |
| 9router | 1 |
| @penpot/mcp | 1 |
| @react-native-community/cli-server-api | 1 |
| @vaadin/charts | 1 |
| @vaadin/component-base | 1 |
| angular | 1 |
