Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

License

NotificationsYou must be signed in to change notification settings

nodejs/is-my-node-vulnerable

Use this GitHub action with your project
Add this Action to an existing workflow or create a new one
View on Marketplace

This package helps ensure the security of your Node.js installation by checking for known vulnerabilities.It compares the version of Node.js you have installed (process.version) to theNode.js Security Databaseand alerts you if a vulnerability is found.

Usage

npx is-my-node-vulnerable

It's strongly recommended to include this as a step in the app CI.

Note

For retro-compatibility enthusiasts: This module supports Node.js versions >= v0.12.However, npx does not work with those older versions, so you'll need to install thepackage and run index.js manually. If you encounter errors when using npx, it'slikely because you're using a vulnerable version of Node.js. Please consider upgrading.

Output - When vulnerable

$node -vv20.3.0$npx is-my-node-vulnerable██████   █████  ███    ██  ██████  ███████ ████████   ██ ██   ██ ████   ██ ██       ██      ██   ████   ██ ███████ ██ ██  ██ ██   ███ █████   ████████   ██ ██   ██ ██  ██ ██ ██    ██ ██      ██   ████████  ██   ██ ██   ████  ██████  ███████ ██   ██The current Node.js version (v20.3.0) is vulnerable to the following CVEs:CVE-2023-30581: The use of proto in process.mainModule.proto.require() can bypass the policy mechanism and require modules outside of the policy.json definitionPatched versions: ^16.20.1 || ^18.16.1 || ^20.3.1==================================================================================================================================================================================

Output - When non-vulnerable

$node -vv20.17.0$npx is-my-node-vulnerable █████  ██      ██           ██████   ██████   ██████  ██████         ████   ██ ██      ██          ██       ██    ██ ██    ██ ██   ██     ██  █████████ ██      ██          ██   ███ ██    ██ ██    ██ ██   ██         ████   ██ ██      ██          ██    ██ ██    ██ ██    ██ ██   ██     ██  ████   ██ ███████ ███████      ██████   ██████   ██████  ██████         ██

Output - when end of life

$node -vv15.14.0$npx is-my-node-vulnerable██████   █████  ███    ██  ██████  ███████ ████████   ██ ██   ██ ████   ██ ██       ██      ██   ████   ██ ███████ ██ ██  ██ ██   ███ █████   ████████   ██ ██   ██ ██  ██ ██ ██    ██ ██      ██   ████████  ██   ██ ██   ████  ██████  ███████ ██   ██v15.14.0 is end-of-life. There are high chances of being vulnerable. Please upgrade it.

End-of-Life versions don't keep track of recent security releases, therefore, it's considered vulnerable by default.

API

This package also exports a functionisNodeVulnerable to perform the check at runtime

Note

The API is only supported on active Node.js versions (v18.x, v20.x, v22.x, v23.x)

import{isNodeVulnerable}from'is-my-node-vulnerable'awaitisNodeVulnerable('19.0.0')// true

Optionally, you can define the platform with the argumentplatform to limit the scope. The available platforms arethe same values available inos.platform().

import{isNodeVulnerable}from'is-my-node-vulnerable'awaitisNodeVulnerable('19.0.0','linux')// true

Github Action

This package also provides a GitHub Action, just include thenode-version in the yml as follows in order to check a specific version:

name:"Node.js Vulnerabilities"on:schedule:    -cron:"0 0 * * *"jobs:is-my-node-vulnerable:runs-on:ubuntu-lateststeps:      -uses:actions/checkout@v3      -name:Check Node.jsuses:nodejs/is-my-node-vulnerable@v1with:node-version:"22.15.0"

Optionally, you can define the platform with the argumentplatform to limit the scope. The available platforms arethe same values available inos.platform().

      -uses:actions/checkout@v3      -name:Check Node.jsuses:nodejs/is-my-node-vulnerable@v1with:node-version:"22.15.0"platform:"linux"

About

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

Resources

License

Code of conduct

Contributing

Security policy

Stars

Watchers

Forks

Sponsor this project

  •  

Packages

No packages published

Contributors7

[8]ページ先頭
©2009-2026 Movatter.jp