stack alerts
npm vulnerability alerts for your stack
Pick what your app uses. You'll see the latest critical and high severity advisories for those packages, the version that fixes each one, and a prompt you can paste into Cursor, Claude Code, Lovable or any AI agent to check your project and upgrade it.
1. pick what your app is built with
2. get an email when a new one lands
Email alerts are coming soon. The list on this page updates every hour.
$ recent serious advisories
Pick a tool to see its latest critical and high severity advisories, with the version that fixes each one.
How the alerts work
- Every hour, the alerts read GitHub's reviewed advisory database for npm and match each advisory to the tools you picked.
- You get an email for critical and high severity advisories, and for any advisory whose CVE is in CISA's catalog of vulnerabilities exploited in the wild. Lower severity ones stay on this page.
- Each email lists the affected versions, the fixed version and one prompt for your AI agent that checks your lockfile first and only changes what's affected.
- The first email is a link to confirm, and nothing else is sent until you do. Every alert has a link to change your tools or unsubscribe, and unsubscribing deletes your address.
Source: the GitHub Advisory Database (reviewed npm advisories) and the CISA Known Exploited Vulnerabilities catalog.
Vulnerabilities by tool
The latest advisories for one tool, with affected and fixed versions.
- Next.js
- React
- Vite
- React Router and Remix
- Astro
- SvelteKit
- Nuxt and Vue
- MongoDB and Mongoose
- Postgres (pg)
- Clerk
- Auth.js (NextAuth)
- Better Auth
- JWT libraries
- Vercel AI SDK
- LangChain
- MCP SDK
- Express
- Hono
- axios
- Socket.IO
- Nodemailer
Looking for the biggest recent ones across the web? See the zero days list.
Questions
How do I see npm vulnerabilities in my project?
Run npm audit in your project folder. It lists each vulnerable package in your dependency tree, its severity and the version that fixes it. pnpm audit does the same for pnpm projects.
How do I fix npm security vulnerabilities?
Upgrade the affected package to the fixed version. npm audit fix does this when the fix is within your allowed version range. npm audit fix --force also installs major upgrades that can break things, so test after. If the package comes in through another one, upgrade that parent package or pin a safe version with overrides in package.json.
What are vulnerabilities in npm packages?
Security bugs in published packages, recorded as advisories with the affected versions and the version that fixes them. They matter when your app installs an affected version, directly or through another package.
What is the GitHub Advisory Database?
GitHub's public database of security advisories for open source packages, npm included. Reviewed advisories have been checked by GitHub and list the affected and patched versions. These alerts read the reviewed npm advisories.
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog from the US Cybersecurity and Infrastructure Security Agency. It lists vulnerabilities with evidence of being exploited in the wild. An advisory whose CVE is on it gets an email whatever its severity.
How is this different from Dependabot alerts?
Dependabot alerts work per repository on GitHub and read your dependency files. These alerts need no access to your code: you pick the tools you build on, and each email carries a prompt your AI agent can run against your lockfile.
How often are advisories checked?
Every hour. When a new critical or high advisory, or one in CISA's catalog, matches a tool you picked, you get an email.