Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parserCVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoSCVE-2024-52798 path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xCVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parametersCVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsingCVE-2026-12590 body-parser: body-parser: Denial of Service via invalid limit optionCVE-2024-47764 cookie: cookie accepts cookie name, path, and domain with out of bounds charactersCVE-2024-43796 express: Improper Input Handling in Express RedirectsCVE-2026-2391 qs: qs's arrayLimit bypass in comma parsing allows denial of serviceCVE-2024-43799 send: Code Execution Vulnerability in Send LibraryCVE-2024-43800 serve-static: Improper Sanitization in serve-staticYour dependencies cross-checked against the OSV vulnerability database.
GHSA-qwcr-r2fm-qrc7 body-parser vulnerable to denial of service when url encoding is enabledGHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect()GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersGHSA-rhx6-c78j-4q9w path-to-regexp contains a ReDoSGHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p serve-static vulnerable to template injection that can lead to XSSGHSA-v422-hmwv-36x6 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds charactersGHSA-w7fw-mjwx-w883 qs's arrayLimit bypass in comma parsing allows denial of serviceCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.