Skip to content
BuildThenTestedSee packages
HighDeploy and config

Dependencies with known vulnerabilities

A published advisory is a public instruction sheet, so an attacker does not need to find a flaw in your code; they only need to know which library version you run. How code reaches production and how the server is configured. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

$ npm audit
# npm audit report

next  <14.2.25
Severity: critical
Authorization Bypass in Next.js Middleware - GHSA-...
fix available via `npm audit fix`

jsonwebtoken  <=8.5.1
Severity: high
An audit of a project's installed packages, listing libraries that have published security advisories and the version that fixes each one.

What happens

A published advisory is a public instruction sheet, so an attacker does not need to find a flaw in your code; they only need to know which library version you run.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Georgia Tech's Systems Software and Security Lab, tracking public security advisories for vulnerabilities attributed to AI-generated code, counted about 18 cases in the second half of 2025 and 35 in March 2026 alone.

  • more than 43,000 Security advisories scanned
  • about 18 AI-attributed CVE cases, July to December 2025
  • 35 AI-attributed CVE cases, March 2026

Apr 2026 · Georgia Institute of Technology, Research News · all sources

Snyk showed that GitHub Copilot uses open files as context: when a neighbouring file contained an SQL injection, the next suggestion reproduced the same pattern, taking the project from one SQL injection to two.

  • from 1 to 2 SQL injections in demo project after suggestion

Feb 2024 · Snyk Labs · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
  2. If the code lives on GitHub, open the repository, choose Settings, then Advanced Security (or Code security), and confirm Dependabot alerts are turned on; then look at the Security tab.
  3. A bad result is any line marked high or critical in the audit output, or Dependabot alerts that have stayed open for more than a few days. It is also a bad result if the builder gives you no way to see the dependency list at all.

What we check

We resolve the full dependency tree, including packages the builder pinned for you, match it against the GitHub Advisory Database, and confirm whether each vulnerable function is reachable from your app rather than only installed. The report separates reachable findings from noise.

Fix direction

Turn on Dependabot alerts (GitHub's built-in scanner for known vulnerable packages) or run npm audit in your build step, and update the flagged packages to the fixed versions. Ask the AI tool to regenerate against the current major version of the framework; it will often pin an older one it has seen more of.

Mechanism documented in: GitHub Docs: About Dependabot alerts (verified 2026-09-21); npm Docs: npm audit (verified 2026-09-21).

Covered by

Pre-launch check ($490, 48 hours) and Full audit ($1,900, 5 business days)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • No automated checks before deployDeploy and config

    Type errors, broken imports and failing behaviour are discovered by users after deploy rather than by a machine before it, and each fix is another untested push.

    Medium
  • Every change goes straight to productionDeploy and config

    A broken build, a bad migration or an agent's misjudged edit reaches real users and real data first, with no place where it could have been caught.

    Medium
  • Debug mode left on in productionDeploy and config

    Anyone who causes an error sees file paths, query text and sometimes environment values, and dev-only shortcuts such as skipped checks or seeded test users stay active for real visitors.

    Medium
  • Missing security headersDeploy and config

    Without these headers a browser will happily load the app inside someone else's page, over plain HTTP, or with injected scripts, which turns an otherwise small bug into a working attack.

    Medium

Questions

how do i check my app for vulnerable dependencies

Run npm audit in the project folder, or connect the repository to GitHub and turn on Dependabot alerts under the Security settings. Both compare your installed package versions to a database of published advisories. Anything marked high or critical should be updated to the version the advisory names.

why does ai generated code use old package versions

Models are trained on code that was written before the current versions existed, so they tend to reproduce the versions and patterns they saw most. Snyk showed that assistants also copy what is already in the project, so an outdated dependency tends to stay outdated. Ask the tool for the current version explicitly and let an audit tool confirm it.

is npm audit enough to find security problems

It finds packages with published advisories and nothing else. It does not know whether your app calls the vulnerable code, so it produces both noise and misses. Treat it as one automatic check in the build pipeline, and pair it with a test of your own routes and data rules.

Back to the catalogue, or run the self-check for your stack.