Latest npm and Composer advisories

New vulnerabilities in the 210 most used npm and Composer packages, newest first. Look up any other package or advisory by name.

Newest advisories

  • MediumCVE-2026-118764GHSA-g3hv-75wg-m24930 Oct 2026

    minimatch has potential denial of service via globparts amplification

    minimatchnpm

  • MediumCVE-2026-118773GHSA-3g3m-2fjr-6pw430 Oct 2026

    Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal

    globnpm

  • LowCVE-2026-118775GHSA-4642-5mcj-2rqw30 Oct 2026

    Forge: ASN.1 OID first arc truncation in asn1.oidToDer

    node-forgenpm

  • MediumCVE-2026-118777GHSA-6wvx-3r32-xmcg30 Oct 2026

    Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie

    node-forgenpm

  • MediumCVE-2026-118778GHSA-525v-9gp9-w22h30 Oct 2026

    Forge: TLS client crash when the server sends no certificate

    node-forgenpm

  • HighCVE-2026-118779GHSA-7wch-p9px-956x30 Oct 2026

    Forge: Regular expression denial of service in PEM decoding (pem.decode)

    node-forgenpm

  • LowCVE-2026-118781GHSA-h6cr-wjv9-3cpp30 Oct 2026

    Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

    node-forgenpm

  • LowCVE-2026-118780GHSA-4487-j8r4-4g2f30 Oct 2026

    Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store

    node-forgenpm

Find out which of your client projects these affect

NPMscan reads the lockfiles in each GitHub repo you pick, npm, Yarn, pnpm and Composer, checks every installed version against these advisories and gives you the command that fixes each one.

Scan a project free, no signupOr connect GitHub to scan every repo
  • MediumCVE-2026-119186GHSA-5cwg-6vw7-rj6p30 Oct 2026

    Forge: AES-GCM authentication bypass via unvalidated tagLength option

    node-forgenpm

  • HighCVE-2026-118782GHSA-jc66-7q78-782g30 Oct 2026

    Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count

    node-forgenpm

  • HighCVE-2026-119188GHSA-8hrf-8g6f-7xwp30 Oct 2026

    Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message

    node-forgenpm

  • HighCVE-2026-119187GHSA-hqq3-7jhf-c5jx30 Oct 2026

    Forge: Denial of service in TLS record processing via call stack exhaustion

    node-forgenpm

  • HighCVE-2026-119190GHSA-5x38-2vff-x55p30 Oct 2026

    Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

    node-forgenpm

  • MediumCVE-2026-119193GHSA-9vw2-f4vp-x7gf30 Oct 2026

    PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling

    phpunit/phpunitComposer

  • MediumCVE-2026-119200GHSA-9v7c-q64q-vv3330 Oct 2026

    Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

    nuxt@nuxt/nitro-servernpm

  • HighCVE-2026-116689GHSA-mrwp-f3q8-3g9p30 Oct 2026

    follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects

    follow-redirectsnpm

  • MediumCVE-2026-118662GHSA-8g5g-mxqh-grgj29 Oct 2026

    Vite: `server.fs.deny` bypassed with queries

    vitenpm

  • HighCVE-2026-116675GHSA-mf2p-h6hf-fcwm27 Oct 2026

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization

    tinymcetinymce/tinymcenpm

  • HighCVE-2026-109829GHSA-4w7w-5xrc-9h2627 Oct 2026

    undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects

    undicinpm

  • HighCVE-2026-109383GHSA-2m5v-pch6-74hx27 Oct 2026

    undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent

    undicinpm

  • HighCVE-2026-87018GHSA-qrxm-fqhp-jwvm27 Oct 2026

    undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

    undicinpm

  • MediumCVE-2026-109932GHSA-9fm3-97px-rjf627 Oct 2026

    undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering

    undicinpm

  • MediumCVE-2026-87029GHSA-55wc-3pg8-jfw627 Oct 2026

    undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor

    undicinpm

  • HighCVE-2026-108082GHSA-r925-mgvr-h9cc27 Oct 2026

    Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header

    symfony/http-foundationsymfony/symfonyComposer

  • MediumCVE-2026-110816GHSA-6pq8-jhm2-2vcw27 Oct 2026

    qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

    qsnpm

  • HighCVE-2026-109855GHSA-qq8j-7v2v-3rwp27 Oct 2026

    undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake

    undicinpm

  • MediumCVE-2026-108360GHSA-2phh-27fw-q4gc27 Oct 2026

    PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading

    phpoffice/phpspreadsheetComposer

  • HighCVE-2026-108359GHSA-j2w7-387v-m2rq27 Oct 2026

    PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

    phpoffice/phpspreadsheetComposer

  • HighCVE-2026-108358GHSA-3x94-m842-937c27 Oct 2026

    PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service

    phpoffice/phpspreadsheetComposer

  • HighCVE-2026-108357GHSA-rxj4-h86g-25gc27 Oct 2026

    PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service

    phpoffice/phpspreadsheetComposer

Browse by package

npm

Composer

All 210 packages

Advisory data from OSV.dev (opens OSV.dev in a new tab), last checked 1 Nov 2026.