How to Check npm Dependencies for Known CVEs (2025 Guide)

# How to Check npm Dependencies for Known CVEs (2025 Guide)

TL;DR: To check npm dependencies for known CVEs, run npm audit for a quick scan, use npm audit --json for detailed output, and integrate a continuous security scanner like OverMCP for automated, real-time monitoring. This guide covers built-in tools, third-party services, and best practices to keep your app secure.

Modern JavaScript development relies heavily on npm packages. With thousands of dependencies in a typical project, a single vulnerable package can expose your app to attacks. According to the npm security team, over 1,500 new vulnerabilities are reported each month. Checking your dependencies for known CVEs (Common Vulnerabilities and Exposures) is no longer optional—it's a critical part of the development workflow.

What Are CVEs and Why Should You Care?

A CVE is a publicly disclosed security vulnerability in a software package. When a vulnerability is found in an npm package, it gets assigned a CVE ID (e.g., CVE-2024-12345) and a severity score (CVSS). Attackers actively scan for apps using vulnerable versions of packages like lodash, express, or axios. If you're using a version with a known CVE, your app is at risk.

Built-in npm Audit: The First Line of Defense

npm includes a built-in auditing tool that checks your dependencies against the npm advisory database. Here's how to use it:

1. Run a Basic Audit

cd your-project
npm audit

This command scans package-lock.json (or yarn.lock) and reports vulnerabilities in a table format:

found 12 vulnerabilities (5 low, 4 moderate, 2 high, 1 critical)
  run `npm audit fix` to fix them, or `npm audit` for details

2. Get JSON Output for CI/CD

For automated pipelines, use the --json flag:

npm audit --json > audit-results.json

3. Fix Automatically (with caution)

npm audit fix

This updates packages to patched versions where possible. Note: it may introduce breaking changes, so always test.

Limitations of npm audit

Step-by-Step: How to check npm dependencies cve with npm audit

Let's walk through a real-world example using a Next.js app built with Bolt.new:

# 1. Navigate to your project
cd ~/projects/my-ai-app

# 2. Run npm audit
npm audit

Example output:

# npm audit report

lodash  <=4.17.20
Severity: high
Regular Expression Denial of Service (ReDoS) - https://npmjs.com/advisories/1523
Fix available via `npm audit fix --force`
Will install lodash@4.17.21, which is a breaking change
node_modules/lodash

  express  <=4.17.1
  Severity: moderate
  Open Redirect - https://npmjs.com/advisories/1556
  Fix available via `npm audit fix`
  node_modules/express

# 3. Fix what you can
npm audit fix

# 4. For breaking changes, manually update
npm install lodash@4.17.21 --save

# 5. Re-run audit to verify
npm audit

Advanced: Using npm audit fix --force

Use with caution. It will install semver-major updates that may break your app:

npm audit fix --force

Beyond npm audit: Third-Party Tools

For production apps, consider:

Automating CVE Checks in CI/CD

Integrate audit into your pipeline to catch vulnerabilities before deployment:

GitHub Actions Example

name: Security Scan
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm audit

Fail the Build on Critical Vulnerabilities

npm audit --audit-level=critical

If npm audit finds any critical vulnerability, it exits with a non-zero code, failing the build.

Real-World Example: Fixing a High CVE in a Vibe-Coded App

Suppose you built a SaaS dashboard with v0 and deployed it. Here's how to check for CVEs and fix them:

# 1. Clone your repo
git clone https://github.com/yourname/your-app.git
cd your-app

# 2. Install dependencies
npm install

# 3. Run audit
npm audit

# Output shows: axios@0.21.1 has CVE-2021-3749 (high)

# 4. Fix by upgrading axios
npm install axios@0.21.4 --save

# 5. Re-run audit to confirm
npm audit
# Should show 0 vulnerabilities for that package

Best Practices to Keep CVEs Low

How OverMCP Helps

OverMCP automates CVE scanning for vibe-coded apps. It connects to your GitHub repo, scans all dependencies on every push, and alerts you via Slack or email when a new vulnerability is discovered. Unlike npm audit, OverMCP provides historical tracking, severity filtering, and fix suggestions tailored to your stack.

FAQ

What does `npm audit` check?

npm audit checks your project's dependencies against the npm advisory database, which contains known CVEs reported to npm. It scans both direct and transitive dependencies listed in your lockfile.

How often should I check npm dependencies for CVEs?

At minimum, run npm audit before every production deployment. For continuous monitoring, integrate it into your CI/CD pipeline or use a tool like OverMCP that scans on every commit and notifies you of new vulnerabilities in real-time.

Can `npm audit` fix all vulnerabilities?

No. npm audit fix only updates to patched versions within your semver range. For breaking changes, you need to manually update the package. Some vulnerabilities may not have a fix available yet; in that case, consider using a different package or applying a workaround.