Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2019-10744 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying propertiesCVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parserCVE-2024-29041 express: cause malformed URLs to be evaluatedCVE-2020-8203 nodejs-lodash: prototype pollution in zipObjectDeep functionCVE-2021-23337 nodejs-lodash: command injection via templateCVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template importsCVE-2020-28500 nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functionsCVE-2025-13465 lodash: prototype pollution in _.unset and _.omit functionsCVE-2026-2950 lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypassCVE-2021-23343 nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathReCVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoSCVE-2024-52798 path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xCVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parametersCVE-2021-21353 pug: user provided objects as input to pug templates can achieve remote code executionCVE-2024-36361 Pug allows JavaScript code execution if an application accepts untrusted inputCVE-2021-21353 pug: user provided objects as input to pug templates can achieve remote code executionCVE-2024-36361 Pug allows JavaScript code execution if an application accepts untrusted inputCVE-2022-24999 express: "qs" prototype poisoning causes the hang of the node processCVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsingCVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headersCVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragmentsCVE-2021-32640 nodejs-ws: Specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws serverCVE-2026-12590 body-parser: body-parser: Denial of Service via invalid limit optionCVE-2024-47764 cookie: cookie accepts cookie name, path, and domain with out of bounds charactersCVE-2024-43796 express: Improper Input Handling in Express RedirectsYour dependencies cross-checked against the OSV vulnerability database.
GHSA-jf85-cpcp-j695 Prototype Pollution in lodashGHSA-qwcr-r2fm-qrc7 body-parser vulnerable to denial of service when url encoding is enabledGHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect()GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLsGHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodashGHSA-35jh-r3h4-6jhm Command Injection in lodashGHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`GHSA-p6mc-m468-83gw Prototype Pollution in lodashGHSA-hj48-42vr-x3v9 Regular Expression Denial of Service in path-parseGHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersGHSA-rhx6-c78j-4q9w path-to-regexp contains a ReDoSGHSA-3965-hpx2-q597 Pug allows JavaScript code execution if an application accepts untrusted inputGHSA-p493-635q-r6gr Remote code execution via the `pretty` option.GHSA-3965-hpx2-q597 Pug allows JavaScript code execution if an application accepts untrusted inputGHSA-p493-635q-r6gr Remote code execution via the `pretty` option.GHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-hrpp-h998-j3pp qs vulnerable to Prototype PollutionGHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p serve-static vulnerable to template injection that can lead to XSSGHSA-3h5v-q93c-6h6q ws affected by a DoS when handling a request with many HTTP headersGHSA-6fc8-4gx4-v693 ReDoS in Sec-Websocket-Protocol headerGHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunksGHSA-v422-hmwv-36x6 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-pxg6-pf52-xh8x cookie accepts cookie name, path, and domain with out of bounds charactersCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.