Npm vulnerabilities
We track 3 vulnerabilities in Npm products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on January 23, 2026.
Latest Npm vulnerabilities
- 7.0 High severity
cli: Incorrect Permission Assignment for Critical Resource
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on
- 8.8 High severity
@fastify/oauth2: Cross-Site Request Forgery
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be uniqu
- 7.5 High severity
npm: Exposure of Sensitive Information to an Unauthorized Actor
npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` inside a workspace, as of v7.9.0 and v7.