How to Fix npm audit Vulnerabilities: Step-by-Step Guide

How to Fix npm audit Vulnerabilities: Step-by-Step Guide

TL;DR: How to Fix npm audit Vulnerabilities

Run npm audit fix to automatically install compatible updates, or npm audit fix --force to apply breaking updates. For unresolved issues, manually update packages, override resolutions, or use npm audit to review and decide on acceptable risks. Always test after fixes.

Understanding npm audit

npm audit scans your node_modules and package-lock.json for known vulnerabilities (CVEs) in your dependencies. It outputs a table of vulnerabilities with severity levels (Critical, High, Moderate, Low) and suggests fixes.

Example output:

=== npm audit security report ===

# Run  npm install  to install 10 vulnerabilities (5 moderate, 5 high)

  Moderate        Regular Expression Denial of Service
  Package:        debug
  Dependency of:  express
  Path:           express > debug
  More info:      https://npmjs.com/advisories/...

Step 1: Run npm audit fix

The simplest fix is npm audit fix. It updates your package-lock.json and installs patched versions of vulnerable dependencies without breaking semver.

npm audit fix

If vulnerabilities remain, the tool couldn't update without changing the major version. Use --force to allow semver-breaking updates:

npm audit fix --force

Caution: --force may introduce breaking changes. Always test your app.

Step 2: Manually Update Packages

When npm audit fix fails, update the vulnerable package directly.

Example: If lodash is vulnerable and your project uses ^4.17.15, you can run:

npm install lodash@4.17.21

Check the advisory for the patched version.

Step 3: Use Overrides or Resolutions

If a direct dependency doesn't update its vulnerable sub-dependency, you can force a specific version.

For npm (>=8): Add an overrides field in package.json:

{
  "overrides": {
    "debug": "3.2.7"
  }
}

For Yarn: Use resolutions in package.json:

{
  "resolutions": {
    "debug": "3.2.7"
  }
}

Then run npm install or yarn install.

Step 4: Remove or Replace Vulnerable Packages

If a package is no longer maintained and has no patch, consider replacing it. For example, if request (deprecated) has a vulnerability, switch to node-fetch or axios.

Step 5: Audit and Accept Risks

Some vulnerabilities may be low risk if the exploit path is not used in your app. Run npm audit to review details:

npm audit --json

You can suppress warnings by adding --audit-level:

npm audit --audit-level=high

But be careful: ignoring vulnerabilities is a security debt.

Automating Vulnerability Fixes

Add npm audit fix to your CI/CD pipeline to catch vulnerabilities early:

# .github/workflows/audit.yml
name: npm audit
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
      - run: npm ci
      - run: npm audit

Best Practices to Prevent Vulnerabilities

Real-World Example

Suppose your app uses express@4.17.1 which depends on qs@6.7.0 with a Critical prototype pollution vulnerability. Running npm audit shows:

Critical        Prototype Pollution
Package:        qs
Dependency of:  express
Path:           express > qs

npm audit fix might upgrade express to 4.18.2 which uses qs@6.11.0 (patched). If not, you can override:

{
  "overrides": {
    "qs": "6.11.0"
  }
}

Then npm install and re-run npm audit to confirm.

Conclusion

Fixing npm audit vulnerabilities is essential for security. Start with npm audit fix, then manually update or override. For AI-built apps (vibe-coded), tools like OverMCP can automate scanning and suggest fixes. Always test after changes.

FAQ

What does `npm audit fix` do?

npm audit fix automatically installs patched versions of vulnerable packages within your semver range. It updates package-lock.json and node_modules.

What if `npm audit fix` doesn't fix all vulnerabilities?

If some vulnerabilities remain, try npm audit fix --force to allow breaking changes. Otherwise, manually update the package, use overrides, or replace the package.

How do I ignore a vulnerability in npm audit?

You can use --audit-level to filter by severity (e.g., --audit-level=high ignores low/moderate). For specific advisories, use npm audit --json and manually review. There's no built-in ignore command; consider using a .nsprc file with npm-audit-resolver or a similar tool.