npm storefront-api vulnerabilities

Latest npm storefront-api CVEs

Newest publication first

1. CVE-2020-11883 Diavante vue-storefront-api and storefront-api disclose stack trace

   Published 2020-04-17

   Medium·CVSS 5.3 EPSS 15.2%

   In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.