npm - OSV

MAL-2026-16140

npm/tracker-cloudflare

Malicious code in tracker-cloudflare (npm) 11 Sep

No fix available

MAL-2026-12008

npm/@keyv/cloudflare-kv

Malicious code in @keyv/cloudflare-kv (npm) 04 Aug

No fix available

MAL-2026-6016

npm/@mastra/deployer-cloudflare

Malicious code in @mastra/deployer-cloudflare (npm) 17 Jun

No fix available

MAL-2026-6008

npm/@mastra/cloudflare

Malicious code in @mastra/cloudflare (npm) 17 Jun

No fix available

MAL-2026-6009

npm/@mastra/cloudflare-d1

Malicious code in @mastra/cloudflare-d1 (npm) 17 Jun

No fix available

MAL-2026-5217

npm/autotel-cloudflare

Malicious code in autotel-cloudflare (npm) 05 Jun

No fix available

GHSA-88gm-j2wx-58h6

npm/@astrojs/cloudflare

Cloudflare has SSRF via redirect following through its image-binding-transform endpoint (incomplete fix for GHSA-qpr4) 23 Apr

Fix available
Severity - 2.2 (Low)

GHSA-c7mq-gh6q-6q7c

npm/@opennextjs/cloudflare

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass 05 Mar

Fix available
Severity - 7.7 (High)

MAL-2025-191327

npm/@trpc-rate-limiter/cloudflare

Malicious code in @trpc-rate-limiter/cloudflare (npm) 24 Nov 2025

No fix available

GHSA-qpr4-c339-7vq8

npm/@astrojs/cloudflare

Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter 04 Sep 2025

Fix available
Severity - 7.2 (High)

MAL-2025-6880

npm/cloudflare-agent-starter

Malicious code in cloudflare-agent-starter (npm) 15 Aug 2025

No fix available

MAL-2025-29409

npm/plugin-cloudflare

Malicious code in plugin-cloudflare (npm) 14 Aug 2025

No fix available

MAL-2025-6035

npm/@toptal/davinci-cloudflare-requests-handler

Malicious code in @toptal/davinci-cloudflare-requests-handler (npm) 20 Jul 2025

No fix available

GHSA-4pfg-2mw5-f8jx

npm/@cloudflare/vite-plugin

Cloudflare Vite plugin exposes secrets over the built-in dev server 08 Jul 2025

Fix available
Severity - 6.9 (Medium)

GHSA-rvpw-p7vw-wj3m

npm/@opennextjs/cloudflare

OpenNext for Cloudflare (opennextjs-cloudflare) has a SSRF vulnerability via /_next/image endpoint 16 Jun 2025

Fix available
Severity - 7.8 (High)

GHSA-qgp8-v765-qxx9

npm/@cloudflare/workers-oauth-provider

@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack 01 May 2025

Fix available
Severity - 5.3 (Medium)

Vulnerabilities