npm packages vulnerabilities and fixes

CVEs that mention npm packages, ranked by priority. 3 tracked.

npm packages has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-08-06. Highest priority: CVE-2026-34841 (score 48/100).

• CVE-2026-34841 CRITICAL 9.8 UPGRADE Bruno is an open source IDE for exploring and testing APIs
• CVE-2026-19041 MEDIUM 6.3 A vulnerability has been found in MissionSquad mcp-api up to 1.11.8
• CVE-2026-71243 HIGH 8.8 The backmeup npm package assembles shell command strings by directly concatenating its option values (name, so

FAQ

How do I fix npm packages vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is npm packages being exploited right now?

None of the tracked npm packages CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which npm packages CVE should I patch first?

CVE-2026-34841 currently ranks highest (48/100): Bruno is an open source IDE for exploring and testing APIs.

← Back to latest CVEs