npm @astrojs/node

Name: npm @astrojs/node
Brand: npm

productUS

pkg:npm/%40astrojs/node

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

critical

by severity

0critical4high1medium0low

updated 2026-10-28

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-25545US	high8.6	1.93% (80th)	—	9.5.4	2026-02-24	< 9.5.4
CVE-2025-55303US	medium6.1	0.64% (50th)	—	9.1.1	2025-08-19	< 9.1.1
CVE-2025-55207US	—	0.57% (47th)	—	9.4.1	2025-08-15	< 9.4.1
CVE-2026-27729US	high7.5	0.48% (41st)	—	9.5.4	2026-02-24	9.0.0 → 9.5.4
CVE-2026-59730US	—	0.46% (40th)	—	11.0.2	2026-07-27	8.1.0 → 11.0.2
CVE-2026-29772US	high7.5	0.39% (32nd)	—	10.0.0	2026-03-24	< 10.0.0
CVE-2026-102984US	—	0.36% (30th)	—	11.1.3	2026-09-30	< 11.1.3
CVE-2026-27829US	high7.2	0.32% (25th)	—	9.5.4	2026-02-26	9.0.0 → 9.5.4
CVE-2026-41322US	—	0.29% (21st)	—	10.0.5	2026-04-24	< 10.0.5

The flaw types (CWEs) most of these CVEs share.

CWE-601URL Redirection to Untrusted Site ('Open Redirect')2 CVEs
CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs
CWE-115Misinterpretation of Input1 CVEs
CWE-248Uncaught Exception1 CVEs
CWE-525Use of Web Browser Cache Containing Sensitive Information1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.