Skip to content
OpenAdvisories

Package · Wolfi

pnpm-stage0

46 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-59873

    node-tar: Decompression/parse DoS via unlimited input

    node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.19, node-tar does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio in extraction and parsing paths such as src/extract.ts, allowing a small …

    isaacs node-tar prism lerna Debian Ubuntu Wolfi npm
  • Critical 9.8
    CVE-2023-42282

    NPM IP package incorrectly identifies some private IP addresses as public

    The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

    renovate nodejs lerna sqlpad Debian Ubuntu Azure Linux Wolfi npm