# npm (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/npm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/npm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 12 vulnerabilities in npm (npm): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-0775, was published on 23 January 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 12 (0 critical, 0 exploited in the wild) ## About npm (npm) npm is a package manager for JavaScript that hosts and distributes reusable code libraries. ## Latest npm (npm) vulnerabilities - [CVE-2026-0775: npm cli local privilege escalation via uncontrolled module search path](https://junglewise.ai/threats/cve-2026-0775-npm-cli-local-privilege-escalation-via-uncontrolled-module-search) (high, CVSS 7, published 23 Jan 2026) - [CVE-2022-29244: npm pack root-level ignore file bypass in workspaces](https://junglewise.ai/threats/cve-2022-29244-npm-pack-root-level-ignore-file-bypass-in-workspaces) (low, CVSS 3.1, published 2 Jun 2022) - [CVE-2018-7408: npm incorrect permission assignment in mkdir](https://junglewise.ai/threats/cve-2018-7408-npm-incorrect-permission-assignment-in-mkdir) (low, CVSS 3, published 13 May 2022) - [CVE-2021-39134: npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems) (low, CVSS 3.1, published 31 Aug 2021) - [npm public path traversal via symlink navigation](https://junglewise.ai/threats/npm-public-path-traversal-via-symlink-navigation-dd9ade29) (info, published 3 Sep 2020) - [npm content denial of service in HTTP header parser](https://junglewise.ai/threats/npm-content-denial-of-service-in-http-header-parser-4db9bd00) (info, published 3 Sep 2020) - [CVE-2013-4116: npm predictable temporary file symlink privilege escalation](https://junglewise.ai/threats/cve-2013-4116-npm-predictable-temporary-file-symlink-privilege-escalation) (info, CVSS 3.3, published 1 Sep 2020) - [CVE-2020-15095: npm CLI information exposure through logs](https://junglewise.ai/threats/cve-2020-15095-npm-cli-information-exposure-through-logs) (low, CVSS 3.1, published 7 Jul 2020) - [CVE-2019-16777: npm global node_modules binary overwrite](https://junglewise.ai/threats/cve-2019-16777-npm-global-node-modules-binary-overwrite) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2019-16776: npm CLI arbitrary file write via bin field symlink](https://junglewise.ai/threats/cve-2019-16776-npm-cli-arbitrary-file-write-via-bin-field-symlink) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2019-16775: npm CLI arbitrary file write in bin field](https://junglewise.ai/threats/cve-2019-16775-npm-cli-arbitrary-file-write-in-bin-field) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2016-3956: npm Token Leak in CLI authentication](https://junglewise.ai/threats/cve-2016-3956-npm-token-leak-in-cli-authentication) (info, CVSS 7.5, published 31 Jul 2018) ## Most severe npm (npm) vulnerabilities - [CVE-2026-0775: npm cli local privilege escalation via uncontrolled module search path](https://junglewise.ai/threats/cve-2026-0775-npm-cli-local-privilege-escalation-via-uncontrolled-module-search) (high, CVSS 7, published 23 Jan 2026) - [CVE-2022-29244: npm pack root-level ignore file bypass in workspaces](https://junglewise.ai/threats/cve-2022-29244-npm-pack-root-level-ignore-file-bypass-in-workspaces) (low, CVSS 3.1, published 2 Jun 2022) - [CVE-2019-16776: npm CLI arbitrary file write via bin field symlink](https://junglewise.ai/threats/cve-2019-16776-npm-cli-arbitrary-file-write-via-bin-field-symlink) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2019-16775: npm CLI arbitrary file write in bin field](https://junglewise.ai/threats/cve-2019-16775-npm-cli-arbitrary-file-write-in-bin-field) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2019-16777: npm global node_modules binary overwrite](https://junglewise.ai/threats/cve-2019-16777-npm-global-node-modules-binary-overwrite) (low, CVSS 3.1, published 13 Dec 2019) - [CVE-2020-15095: npm CLI information exposure through logs](https://junglewise.ai/threats/cve-2020-15095-npm-cli-information-exposure-through-logs) (low, CVSS 3.1, published 7 Jul 2020) - [CVE-2021-39134: npm Arborist symlink following on case-insensitive filesystems](https://junglewise.ai/threats/cve-2021-39134-npm-arborist-symlink-following-on-case-insensitive-filesystems) (low, CVSS 3.1, published 31 Aug 2021) - [CVE-2018-7408: npm incorrect permission assignment in mkdir](https://junglewise.ai/threats/cve-2018-7408-npm-incorrect-permission-assignment-in-mkdir) (low, CVSS 3, published 13 May 2022) - [CVE-2016-3956: npm Token Leak in CLI authentication](https://junglewise.ai/threats/cve-2016-3956-npm-token-leak-in-cli-authentication) (info, CVSS 7.5, published 31 Jul 2018) - [CVE-2013-4116: npm predictable temporary file symlink privilege escalation](https://junglewise.ai/threats/cve-2013-4116-npm-predictable-temporary-file-symlink-privilege-escalation) (info, CVSS 3.3, published 1 Sep 2020) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "npm (npm) vulnerabilities", https://junglewise.ai/threats/technologies/npm, 13 November 2026.