Package Vulnerability Checker

Check npm, PyPI, Maven, Go and other packages for known vulnerabilities and CVEs, and see which version fixes each.

Package Vulnerability Checker tool

Loading...

Example

Input: Ecosystem npm, package lodash, version 4.17.15

Result: 4 known vulnerabilities, from 6 advisory records (2 High, 2 Medium). Top result: GHSA-35jh-r3h4-6jhm, Command Injection in lodash, fixed in 4.17.21 and 4.18.0.

From a live OSV.dev query on September 25, 2026. GHSA-35jh-r3h4-6jhm and GHSA-r5fr-rjxr-66jc list each other as aliases, as do two prototype pollution advisories, so 6 records become 4 vulnerabilities.

CVSS 3 Base Score Ratings

Base scoreRating
0.0None
0.1 to 3.9Low
4.0 to 6.9Medium
7.0 to 8.9High
9.0 to 10.0Critical

Qualitative severity scale from the CVSS v3.1 specification, used when an advisory has no rating of its own.

  1. Choose the ecosystem, such as npm or PyPI, and type the package name.
  2. Enter the exact version you use, or leave it empty to list every advisory for the package.
  3. Click Check for vulnerabilities to see each issue with its severity, affected versions and fixed version.
  4. Open References or Full description on any result for links to the advisory, patches and write-ups.
  5. To check a whole project, open the package.json tab, paste your file and click Check all dependencies.

How Known Vulnerabilities Are Tracked

Enter a package name and version, and this checker lists the known security vulnerabilities that affect it. For each one you see the severity, the affected versions and the version that fixes it. It covers ten ecosystems: npm, PyPI, Maven, Go, crates.io, RubyGems, NuGet, Packagist, Hex and Pub. The data comes from OSV.dev, a free, open vulnerability database run by Google.

OSV gathers advisories from sources such as the GitHub Advisory Database, the Python advisory database, the Go vulnerability database and RustSec. The same flaw is often filed in several of them under different ids. It may have a GHSA id from GitHub, a PYSEC id and a CVE number. The tool merges records that list each other as aliases. So requests 2.19.0 shows 5 vulnerabilities, not 10 records, and every id links to its source.

Severity comes from the advisory's own rating when there is one, such as GitHub's Low, Moderate, High or Critical. If not, the tool works out the base score from the CVSS 3 vector. It uses the formula in the CVSS 3.1 specification. CVSS (Common Vulnerability Scoring System) rates a flaw from 0 to 10. Newer CVSS 4.0 vectors are shown as text but not scored.

The package.json tab checks all dependencies and devDependencies at once. Version ranges are approximated: ^4.17.15 is checked as 4.17.15, the lowest version the range allows. Your lockfile may already install a newer, fixed version, so treat the list as a starting point, not a full audit. Tags, Git URLs and workspace links are skipped.

Your browser sends only package names and versions to OSV.dev, never the rest of your file. OSV returns an empty list for names it does not know, so a typo also looks clean. No result is not proof that a package is safe. Old packages often sit on an old runtime too, which the Software End-of-Life Checker can check.

Sources

Frequently Asked Questions

Choose npm, enter the package name and the exact version you use, then click Check for vulnerabilities. Each result shows the affected range and the version that fixes it. In a project, npm audit does the same for your whole lockfile. This tool is handy when you are choosing a package or have no project checked out.
A CVE id, such as CVE-2020-8203, is the global name for a vulnerability, assigned through the CVE program. A GHSA id comes from the GitHub Advisory Database and often links to a CVE. Ecosystems add their own ids too, such as PYSEC for Python or GO for Go. They usually describe the same flaw, which is why the tool groups them.
Upgrade to a version at or above the one shown under Fixed in, then run your tests. If the package is pulled in by another dependency, update that parent package, or use overrides in npm or resolutions in Yarn to force a safe version. When no fix is listed, look for a maintained alternative or check whether your code uses the affected feature.
Without a version, OSV returns every advisory that has ever affected any version of the package. That is useful for judging a package's security history, but most of those issues were fixed long ago. Enter the version from your lockfile to see only the problems that apply to you.
The tool uses the rating from the advisory itself first, usually GitHub's Low, Moderate, High or Critical. If there is none, it computes the CVSS 3 base score from the vector string and maps it to the standard bands: 0.1 to 3.9 is Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10 Critical. Advisories without either show Not rated.

Related Tools

Software End-of-Life Checker

See when Node.js, Python, Ubuntu and 470+ other products reach end of life, with the days left for every version.

DevOps Tools

npm Package Size Checker

See the minified and gzipped size of any npm package, its download time, dependency count and whether it tree-shakes.

Developer Tools

Hash Generator

Generate MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes from text or files right in your browser.

Developer Tools

JSON Formatter and Validator

Format, validate, beautify, and minify JSON data with a collapsible tree view and line-and-column error detection.

Developer Tools

JWT Decoder

Decode JSON Web Tokens to inspect header, payload, and signature without needing the secret key.

Developer Tools

Password Strength Checker

Check how strong your password is with a visual meter, entropy score, and estimated crack time.

Security and Encryption