Informational scan, not a security audit. How this is computed.
API keys, passwords or tokens committed into the repo.
Nothing found by this check. ✓
Packages you depend on that have known security holes (CVEs).
CVE-2026-13149 brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexityCVE-2026-14257 brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() functionCVE-2026-69152 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationCVE-2026-27601 Underscore.js: Underscore.js: Denial of Service via recursive data structures in flatten and isEqual functionsCVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragmentsCVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 inputCVE-2026-67213 nanoid: nanoid: Denial of Service via infinite loop in random ID generationCVE-2026-67214 nanoid (Nano ID) before 5.1.16 contains an infinite loop in the custom ...CVE-2026-64641 next: Next.js: Denial of Service via crafted requests to App Router with Server ActionsCVE-2026-64645 next: Next.js: Server-Side Request Forgery vulnerabilityCVE-2026-64649 next: Next.js: Server-Side Request Forgery via malicious host redirection in Server ActionsCVE-2026-64643 next: Next.js: Information disclosure via Server Action ID exposureCVE-2026-64644 next: Next.js: Denial of Service via malicious image optimizationCVE-2026-64646 next: Next.js: Denial of Service via excessive memory consumption in Server ActionsCVE-2026-64647 next: Next.js: Information disclosure via server-side request cachingCVE-2026-64648 next: Next.js: Information disclosure via server-side fetch cacheCVE-2026-45623 postcss: PostCSS: Information disclosure and denial of service via crafted CSS inputGHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureCVE-2026-41305 postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tagsCVE-2026-69153 postcss: PostCSS: Information disclosure via crafted sourceMappingURLGHSA-f88m-g3jw-g9cj sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591CVE-2026-48779 ws: ws: Denial of Service via memory exhaustion from small WebSocket fragmentsCVE-2026-45736 ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`Your dependencies cross-checked against the OSV vulnerability database.
GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groupsGHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crashGHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigationGHSA-848j-6mx2-7j84 Elliptic Uses a Cryptographic Primitive with a Risky ImplementationGHSA-qpx9-hpmf-5gmw Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attackGHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosureGHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunksGHSA-848j-6mx2-7j84 Elliptic Uses a Cryptographic Primitive with a Risky ImplementationGHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative sizeGHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zeroGHSA-4633-3j49-mh5q Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequencesGHSA-4c39-4ccg-62r3 Next.js: Unbounded Server Action payload in Edge runtimeGHSA-68g3-v927-f742 Next.js: Cache confusion of response bodies for requests with bodiesGHSA-89xv-2m56-2m9x Next.js: Server-Side Request Forgery in Server Actions on custom serversGHSA-955p-x3mx-jcvp Next.js: Unauthenticated disclosure of internal Server Function endpointsGHSA-m99w-x7hq-7vfj Next.js: Denial of Service in App Router using Server ActionsGHSA-p9j2-gv94-2wf4 Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostnameGHSA-q8wf-6r8g-63ch Next.js: Denial of Service in the Image Optimization API using SVGsGHSA-6g55-p6wh-862q PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS commentsGHSA-fxqj-rqcc-2cmp PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unsetGHSA-qx2v-qp2m-jg93 PostCSS has XSS via Unescaped </style> in its CSS Stringify OutputGHSA-r28c-9q8g-f849 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File DisclosureGHSA-f88m-g3jw-g9cj sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591GHSA-58qx-3vcg-4xpx ws: Uninitialized memory disclosureGHSA-96hv-2xvq-fx4p ws: Memory exhaustion DoS from tiny fragments and data chunksCode that can be exploited: injection, hardcoded credentials and similar.
Nothing found by this check. ✓
Packages that look intentionally malicious: typosquats, sneaky install scripts.
Nothing found by this check. ✓
A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.
Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.
This check didn’t finish — that’s not the same as “clean.” Try Check again above.