Sign in

v52

latestOpenAPI 3.0.0raw.githubusercontent.com2026-08-03269339953.6 KB
Hosting: NodeJS

List Node.js vulnerabilities

Lists known npm package vulnerabilities detected on a Node.js website, enriched with advisory metadata (severity, CVSS score, CVE, advisory URL). Results are sorted from the most severe to the least severe, then by publish date (newest first). Use the severities query parameter to filter.

Vulnerabilities with is_patchable set to true can be auto-fixed via the Patch Node.js Vulnerabilities endpoint, which opens a GitHub pull request with updated package versions. Auto-fix is only available for websites deployed from a connected GitHub repository. Vulnerabilities with is_patching_in_progress set to true are already included in an open patch pull request; while any patch pull request is open, new patch requests for this website are rejected until it is merged or closed.

Data comes from periodic dependency scans, so it may lag behind the latest deployment. An empty list means the most recent scan found no vulnerabilities; it does not guarantee the current deployment is vulnerability-free. Available on Business and Cloud Hosting plans.

get/api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities

Path parameters

usernamestring required
Example:u123456789
domainstring required
Example:mydomain.tld

Domain name

Query parameters

severitiesstring[]

Severities to filter by

Response

Success response

package_namestring

Name of the affected npm package

installed_versionstring

Version of the package currently installed

is_directboolean

Whether the package is a direct dependency

is_patchableboolean

Whether the vulnerability can be auto-patched without a major version bump

fix_versionstring nullable

Version that fixes the vulnerability, if known

vulnerability_idstring

Unique vulnerability identifier (e.g. GHSA or CVE)

severity'low' | 'moderate' | 'high' | 'critical' | 'unknown'

Severity level of the vulnerability

titlestring

Short human-readable title of the vulnerability

descriptionstring nullable

Detailed description of the vulnerability

cvss_scorenumber float nullable

CVSS base score (0.0-10.0)

cvestring nullable

CVE identifier, if available

cwestring nullable

CWE identifier describing the weakness type

urlstring nullable

URL to the vulnerability advisory

published_atstring date-time nullable

Date the vulnerability was published, in ISO 8601 format

is_patching_in_progressboolean

Whether this vulnerability is included in a currently open patch pull request

Example response

[
  {
    "package_name": "lodash",
    "installed_version": "4.17.0",
    "is_direct": true,
    "is_patchable": true,
    "fix_version": "4.17.21",
    "vulnerability_id": "GHSA-jf85-cpcp-j695",
    "severity": "high",
    "title": "Prototype Pollution in lodash",
    "description": "Versions of lodash prior to 4.17.11 are vulnerable to prototype pollution.",
    "cvss_score": 9.8,
    "cve": "CVE-2019-10744",
    "cwe": "CWE-1321",
    "url": "https://github.com/advisories/GHSA-jf85-cpcp-j695",
    "published_at": "2019-07-26T00:00:00Z"
  }
]