Outdated Dependencies with Known CVEs
npm packages or other dependencies with published security vulnerabilities (CVEs) that haven't been updated, leaving known attack vectors open in your app.
How It Works
When a CVE is published for a package, exploit code often follows within days. If your app runs an old version of `express`, `jsonwebtoken`, or even a transitive dependency, attackers can use the documented exploit directly. The Veracode 2024 report found 70% of apps had at least one vulnerable dependency.
// BAD: package.json with vulnerable versions
{
"dependencies": {
"jsonwebtoken": "8.5.1",
"express": "4.17.1",
"node-fetch": "2.6.0"
}
}// GOOD: run these commands regularly
// npm audit — shows known CVEs
// npm audit fix — auto-fixes non-breaking updates
// npx npm-check-updates -u — bumps all to latest
// Then: npm install && run your testsReal-World Example
The Log4Shell vulnerability (CVE-2021-44228) hit organizations that hadn't updated log4j in years. Companies scrambled over the holiday season to patch a library buried 5 levels deep in their dependency tree.
How to Prevent It
- Run npm audit as part of your CI pipeline and fail builds on high/critical CVEs
- Use Dependabot or Renovate to automate dependency update PRs
- Pin to exact versions in production and use a lockfile (package-lock.json)
- Subscribe to security advisories for your critical dependencies
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
Hardcoded API Keys
criticalAPI keys, tokens, or secrets written directly in source code, making them visible to anyone with repo access — including public GitHub repositories.
No Input Validation
mediumUser-supplied data sent directly to databases or external APIs without any type, format, or content validation.
Passwords Stored in Plaintext
criticalUser passwords stored as raw strings in the database instead of being hashed with a proper algorithm like bcrypt or Argon2.
JWT Without Expiration
highJWTs signed without an `exp` claim that never expire, meaning a stolen token grants permanent access with no way to revoke it.