npm

Everything AppSec Scoop has reported about npm: 2 stories, newest first. Part of our Vulnerabilities coverage.

markdown-it denial of service flaw requires immediate patching for exposed parsers

Security teams must update markdown-it to 14.3.3 or 15.0.3 to resolve a high severity denial of service vulnerability triggered by unclosed link references.

Oct 21, 2026

Dev teams face coding session interruptions from Codex CLI 0.157.0's default hourly background updates

The latest Codex CLI version installs a persistent background service that updates itself hourly, decoupling the backend from the installed package.

Oct 13, 2026