Free outdated JavaScript library checker
Find JavaScript libraries on your live site that are versions with publicly known security holes, and the version that fixes them. It only reads files your page already loads.
What this checks
- Script URLs in your page, including CDN paths like
/jquery@3.4.1/, read from the HTML only. Scripts on other domains are never downloaded. - Your inline scripts and up to 20 same-origin JavaScript files, matched against version signatures for 67 libraries, including jQuery, jQuery UI, Bootstrap, AngularJS, Lodash, Moment.js, Handlebars, DOMPurify, Vue, React, Next.js, axios, Chart.js and pdf.js.
- Exact versions only: a library is listed only when its full version number is readable, so there are no guesses.
- Known vulnerabilities for each version, with their CVE or advisory IDs and the lowest version that fixes all of them.
What it can't tell you
- Bundlers often strip version numbers, so many modern apps show no libraries here even though they use them. Your
package-lock.jsonis the full picture. - It knows the libraries and advisories in its signature list (updated with releases), not every package on npm.
- A known vulnerability isn't always reachable in your app; it's still the simplest thing to fix.
- It checks live web URLs only, not native mobile apps or pages behind a login.
- No issues found means none in this one check at that moment. It is never proof of security.
Check it yourself
In your browser's console on your live site, try jQuery.fn.jquery, _.VERSION, moment.version or angular.version.full. Or from a terminal:
curl -s https://your-app.com/ | grep -oE '[a-z.-]+@[0-9]+\.[0-9]+\.[0-9]+' npm outdated
Then look up the version in your package manager's audit (npm audit) or the library's changelog.
How to fix it
- Upgrade to the fixed version shown (or the latest), in
package.jsonor the CDN URL in your HTML. - Run your tests, since major versions can change behavior.
- Redeploy, then check again.
This checker answers one question. The free scan checks everything at once, and how our scanner works explains what it does and never does.
Questions
Where does the vulnerability list come from?
From RetireJS's community-maintained signature and advisory database (Apache-2.0), which does a great job of tracking front-end library versions. It's bundled with SniffPup, so the check makes no extra network calls.
It found nothing, but I know I use React. Why?
Bundlers usually remove version numbers when they compile your app. We only list a library when we can read its exact version, so we don't guess. Run npm audit in your project for the full picture.
Do you download scripts from CDNs?
No. For scripts on other domains we read the version from the URL in your page. Only same-origin JavaScript files are downloaded, like a browser would.