4,026 CVEs
11 in CISA KEV
npm Vulnerabilities
CVE security advisories and vulnerability history for npm.
4,026
Total CVEs
Published
11
In CISA KEV
Exploited in the wild
1,062
Public exploits
With known exploit
7.0
Avg CVSS
2009–2026
Overview
npm has 4,026 published CVE records since 2009, of which 11 are in CISA's Known Exploited Vulnerabilities catalog and 1,062 have a known public exploit. The average CVSS base score across scored CVEs is 7.0.
This page aggregates every publicly disclosed vulnerability (CVE) affecting npm products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.