Upgrade vulnerable JavaScript libraries
Most sites ship third-party JavaScript libraries, and every version of a popular library eventually has publicly documented vulnerabilities. Because the advisories (and often proof-of-concept exploits) are public, an outdated library is one of the cheapest things for an attacker to find and abuse: it can turn into cross-site scripting or prototype pollution in your visitors' browsers even when your own code is sound.
Find out whether your site has this problem, and every other check, in one free scan.
Check your site freeWhy it matters
Known vulnerabilities in an old library version are public, often with ready-made exploits, so attackers scan for them at scale. A vulnerable jQuery or similar library can let an attacker run script in your visitors' browsers (XSS) even when your own code is correct.
How to fix
- 1 Upgrade each flagged library to a version at or above the fixed release listed in its advisory.
- 2 Check whether the same old version is also bundled into your own build (a transitive dependency) and update it in your lockfile too.
- 3 Remove libraries the page no longer uses rather than upgrading them.
Common mistakes
- Upgrading the copy loaded from a CDN tag but leaving an older copy bundled into the application build via a transitive dependency.
- Pinning an old major version "for compatibility" indefinitely instead of planning the migration, so the library keeps accumulating advisories.
- Treating a clean scan as proof of safety: only libraries whose version can be identified are checked, so a minified bundle without a version banner may go unreported.
How to verify
- 1 Re-run the scan and confirm the library card is gone or shows a version at or above the fixed release.
- 2 Run your package manager's audit (npm audit, yarn audit, pnpm audit) to catch bundled copies the page scan cannot see.
- 3 Open the browser devtools Network tab, filter by JS, and confirm the served file is the upgraded version (not a cached old copy).
Related checks
Ready to see where you stand?
Scan your site and get your Engineering Score with a prioritized roadmap in under a minute, no signup required.