Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2022-2421 Insufficient validation when decoding a Socket.IO packetCVE-2020-28502 nodejs-xmlhttprequest: Code injection through user input to xhr.sendCVE-2021-31597 xmlhttprequest-ssl: SSL certificate validation disabled by defaultCVE-2024-1597 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLECVE-2021-43138 async: Prototype Pollution in asyncCVE-2024-45590 body-parser: Denial of Service Vulnerability in body-parserCVE-2020-36048 yarnpkg-socket.io/engine.io: allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transportCVE-2022-41940 engine.io: Specially crafted HTTP request can trigger an uncaught exceptionCVE-2024-29041 express: cause malformed URLs to be evaluatedCVE-2024-36751 parse-uri Regular expression Denial of Service (ReDoS)CVE-2024-45296 path-to-regexp: Backtracking regular expressions cause ReDoSCVE-2024-52798 path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xCVE-2026-4867 path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parametersCVE-2022-24999 express: "qs" prototype poisoning causes the hang of the node processCVE-2025-15284 qs: qs: Denial of Service via improper input validation in array parsingCVE-2021-29469 Node-redis is a Node.js Redis client. Before version 3.1.1, when a cli ...CVE-2022-25883 nodejs-semver: Regular expression denial of serviceCVE-2020-28481 CORS misconfiguration in socket.ioCVE-2024-38355 socket.io: Unhandled 'error' eventCVE-2020-36049 yarnpkg-socket.io-parser: a denial of service (memory consumption) via a large packet because a concatenation approach is usedCVE-2026-33151 socket.io: Socket.IO: Denial of Service due to excessive buffering of specially crafted packetsCVE-2026-69185 socket.io-parser: Socket.IO: Denial of Service via memory exhaustion from crafted packetsCVE-2023-32695 socket.io parser is a socket.io encoder and decoder written in JavaScr ...CVE-2024-37890 nodejs-ws: denial of service when handling a request with many HTTP headersCVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragmentsYour dependencies cross-checked against the OSV vulnerability database.
GHSA-qm95-pgcg-qqfq Insufficient validation when decoding a Socket.IO packetGHSA-72mh-269x-7mh5 Improper Certificate Validation in xmlhttprequest-sslGHSA-h4j5-c7cj-74xg xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code InjectionGHSA-24rp-q3w6-vc56 org.postgresql:postgresql vulnerable to SQL Injection via line comment generationGHSA-fwr7-v2mv-hh25 Prototype Pollution in asyncGHSA-qwcr-r2fm-qrc7 body-parser vulnerable to denial of service when url encoding is enabledGHSA-j4f2-536g-r55m Resource exhaustion in engine.ioGHSA-r7qp-cfhv-p84w Uncaught exception in engine.ioGHSA-qw6h-vgh9-j6wx express vulnerable to XSS via response.redirect()GHSA-rv95-896h-c2vc Express.js Open Redirect in malformed URLsGHSA-6fx8-h7jm-663j parse-uri Regular expression Denial of Service (ReDoS)GHSA-37ch-88jc-xwx2 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parametersGHSA-rhx6-c78j-4q9w path-to-regexp contains a ReDoSGHSA-6rw7-vpxm-498p qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustionGHSA-hrpp-h998-j3pp qs vulnerable to Prototype PollutionGHSA-35q2-47q7-3pc3 Node-Redis potential exponential regex in monitor modeGHSA-c2qf-rxjj-qqgw semver vulnerable to Regular Expression Denial of ServiceGHSA-m6fv-jmcg-4jfg send vulnerable to template injection that can lead to XSSGHSA-cm22-4g7w-348p serve-static vulnerable to template injection that can lead to XSSGHSA-25hc-qcg6-38wj socket.io has an unhandled 'error' eventGHSA-fxwf-4rqh-v8g3 CORS misconfiguration in socket.ioGHSA-2m8v-j782-fhvr Socket.IO: Zero-attachment Memory ExhaustionGHSA-677m-j7p3-52f9 socket.io allows an unbounded number of binary attachmentsGHSA-cqmj-92xf-r6r9 Insufficient validation when decoding a Socket.IO packetGHSA-xfhh-g9f5-x4m4 Resource exhaustion in socket.io-parserCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.