CodeScoring: critical vulnerabilities in open source software surge

CodeScoring secure development platform analysts have summarized the study of critical vulnerabilities (CVSS 9.0 and above) in open source software from January to September 2026. According to the company's database, information on 3,566 critical vulnerabilities was published over the nine months, which is 4.9 times more than the 723 cases during the same period last year.

• 3,566 critical vulnerabilities in open source software were recorded in the first nine months of 2026
• Critical vulnerabilities in the npm ecosystem increased by 6.3 times, and in Go by 5.1 times
• More than two-thirds of vulnerabilities allow network attacks without preliminary access rights
• The surge is driven by automated search, AI tools, and systematic disclosure by developers

Growth across npm and Go ecosystems Growth rates in specific programming language ecosystems turned out to be multiple times higher. In npm, the JavaScript component catalog, the number of registered critical vulnerabilities increased by 6.3 times from 89 to 562. These issues affected 39,127 stable package versions compared to 3,844 a year earlier, representing a 10.2-fold increase. In Go, the number of critical vulnerabilities grew by 5.1 times from 78 to 396, affecting 12,443 stable module versions compared to 5,995 previously. Researchers note that the expansion of vulnerability databases continues to accelerate worldwide as auditing techniques improve.

Network attack vectors and drivers of growth For more than two-thirds of this year's critical vulnerabilities, CVSS assessments indicate the possibility of network attacks without preliminary access rights or user actions. Attackers do not need to intercept employee credentials or trick them into opening malicious files, as the network-accessible software itself is targeted directly, preserving perimeter compromise risks. Experts attribute the sharp increase in vulnerability reports primarily to more intensive defect searches and expanded tracking. Researchers actively utilize automated analysis and AI-based tools, while a growing number of developers systematically disclose defects found in software components deployed years ago.

Business implications and security recommendations It is critically important for organizations to regularly check their software composition and track new intelligence regarding component vulnerabilities. CodeScoring product analyst Artyom Maksimov emphasizes the need to quickly adapt threat monitoring approaches, controlling risks not only at the assembled vendor software level but also at the component level. Implementing software composition analysis helps establish such control by automatically tracking application composition, identifying vulnerable dependencies, and determining component versions where issues have been resolved.