npm makerjs vulnerabilities

Latest npm makerjs CVEs

Newest publication first

1. CVE-2026-24888 Maker.js Vulnerable to Unsafe Property Copying in makerjs.extendObject

   Published 2026-01-28

   Critical·CVSS 9.8 EPSS 1.00%

   Maker.js is a 2D vector line drawing and shape modeling for CNC and laser cutters. In versions up to and including 0.19.1, the makerjs.extendObject function copies properties from source objects without proper validation, potentially exposing applications to security risks. The f...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.