Node-modules vulnerabilities
We track 3 vulnerabilities in Node-modules products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 25, 2026.
Latest Node-modules vulnerabilities
- 7.5 High severity
urllib: Exposure of Sensitive Information to an Unauthorized Actor
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.
- 7.8 High severity
compressing: Improper Link Resolution Before File Access
Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with t
- 7.8 High severity
compressing: Improper Link Resolution Before File Access
Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extra