Are your JavaScript libraries out of date?
Front-end libraries your site loads, such as jQuery, Bootstrap or Angular, with versions that have known vulnerabilities or are past their end of life.
Why it matters
Known vulnerabilities are public, with details of how to use them. An attacker does not need to find a new weakness in your app if a library you load already has one. Libraries past their end of life no longer receive fixes at all.
How a survey checks it
Passive check: part of every free survey.
We recognise library versions in your homepage and its files using the Retire.js database, and look the versions up in the OSV.dev vulnerability database. Severity follows the published scores. Library names are shown in every report; the advisory details unlock with your email.
How to fix it
- Upgrade to a version that fixes the listed advisories, and test your app afterwards.
- If a file is named after a library version, replace the file itself, not only the reference to it.
- Not every advisory affects every app. If upgrading is hard, check whether you use the affected feature.
Prefer us to do it? Ask for a fix quote
Common questions
Does a known vulnerability mean my app can be hacked?
Not always. Many advisories only apply when a library is used in a particular way. It is still the easiest problem to fix before it matters.
Why do you never rate these as critical?
Because we can see the library version but not how your app uses it. An audit can judge whether a vulnerability can actually be exploited in your app.