Fixing npm audit vulnerabilities in plain English

npm audit compares the packages in your lockfile against a database of known vulnerabilities. The output can look alarming; here is how to read it and act on it.

Run it

From your project folder: npm audit. To see only serious issues: npm audit --audit-level=high. Add --omit=dev to focus on packages that ship to production.

Read the output

• Severity (low, moderate, high, critical) is the advisory's rating, not a measure of risk in your app specifically.
• Direct vs. transitive: many findings are in packages your packages depend on. The "fix available via" line tells you which top-level package to update.
• Dev-only packages (build tools, linters) usually matter less because they don't run in production, but they still run on your machine and in CI.

Fix it, safest first

1. npm audit fix applies updates that stay within your allowed version ranges. Run your build and tests afterwards.
2. For what's left, update the named top-level package directly, e.g. npm install next@latest, and check its release notes for breaking changes.
3. npm audit fix --force may install major versions that break your app. Use it only on a branch, then build and test.
4. If a transitive package has no fix yet, npm's overrides field in package.json can pin a patched version; test carefully.

Prioritize

Start with critical and high findings in production dependencies, especially your framework (Next.js, React, Express) and anything handling auth, uploads or parsing user input. Read the advisory: some only apply if you use a specific feature.

Python projects

The equivalent is pip-audit: pip install pip-audit then pip-audit -r requirements.txt. Upgrade the flagged package to a fixed version and pin it.

Automated checks and general guidance, not a substitute for a professional security audit.

All guides · Home · Terms · Privacy