Is My Node Vulnerable
https://github.com/nodejs/is-my-node-vulnerable- Category
- Cybersecurity
- Rank
- No. 903Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- nodejs
- GitHub
- 327 stars
- Latest release
- v1.6.1
- Date
About
CLI that checks if your installed Node.js version has any known security vulnerabilities.
What it does
It compares a Node release against live security and support-lifecycle data, then reports affected CVEs, patched version ranges, or end-of-life status. Checks can run from a terminal, application code, or GitHub Actions, with optional platform filtering.
Why it's ranked here
This is a focused, practical guardrail for teams that might otherwise miss runtime-level exposure. It uses Node project data, identifies specific CVEs and patched ranges, treats unsupported releases conservatively, and fits scheduled automation. Network and cache behavior keep it from being a complete security control.
What's good
The result is actionable: vulnerable releases show CVE descriptions and patched version ranges. End-of-life releases fail closed instead of appearing safe because recent advisories are unavailable. Platform filtering can remove irrelevant findings, while terminal, library, and GitHub Actions interfaces support several workflows.
Tradeoffs
Checks depend on GitHub-hosted security and release data, and request failures terminate the process rather than returning a recoverable library error. The cache validation contains a property-name mismatch that causes fresh downloads instead of reliable reuse. Library support is documented only for active Node releases, despite broader terminal compatibility.
How to use it well
Add it to continuous integration or a scheduled GitHub Actions job to catch vulnerable runtime versions before deployment. Use the library interface when application logic needs a boolean decision, and specify the target platform when relevant. Pair it with dependency scanning, because this tool assesses Node itself, not installed packages.
Technical notes+
index.js dispatches terminal use to cli and exports isNodeVulnerable for library consumers. is-vulnerable.js fetches Node security and release JSON over HTTPS, stores JSON plus ETags beside the package, evaluates ranges with semver/functions/satisfies, filters affectedEnvironments, and exits with status 1 for vulnerable or end-of-life terminal checks. In getJson, the condition compares obj.eTagValue while the store defines etagValue, so the mismatch makes the refresh branch run. Network and write errors also schedule process.exit(1), including during library calls. action.js maps a true result to a failed GitHub Action. test.js covers vulnerable, invalid, end-of-life, and platform-specific inputs, while setup-test.js checks legacy-runtime behavior.
Observed
- License
- MIT
- Primary language
- JavaScript using CommonJS modules
- Packaging
- Published as an npm package with an npx-compatible executable
- Interfaces
- Terminal command, JavaScript library export, and GitHub Action
- Platform filtering
- Supports aix, darwin, freebsd, linux, openbsd, sunos, win32, and android values
- Dependencies
- Runtime dependencies are semver and the GitHub Actions core toolkit
- Testing structure
- Tests are implemented in root-level test.js and setup-test.js, with no test directory shown
Read from README.md, package.json, index.js, test.js, ascii.js, action.js, setup-test.js, eol-versions.js, is-vulnerable.js, LICENSE, action.yml, .github/workflows/test.yml, .github/workflows/publish.yml.
What it can do
Check Node.js version for security vulnerabilities
Installed Node.js version → Security vulnerability report
Detect known CVEs in Node.js installation
Node.js version number → List of applicable CVEs
Scan system for vulnerable Node.js versions
System environment → Vulnerability assessment results
Validate Node.js security status
Current Node.js installation → Security status confirmation
Generate security recommendations
Vulnerable Node.js version → Recommended security actions
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.