OWASP/NodeGoat · audit

OWASP/NodeGoat ↗ · c5cb68a · Aug 21, 2026, 11:05 PM

We found hard evidence. 9 things need your attention now.We found real evidence of problems. 9 things need your attention now.9 issues need attention now.

Free scan · deterministic evidence onlyFree scan · found by automatic checks onlyFree scan · deterministic evidence only

These are facts from deterministic scanners, not opinion — 9 high/critical dependency vulnerabilities. The full picture — architecture, AI-generated-code risk, privacy, and 11 more dimensions — needs Audit.

These are facts found by automatic checks, not opinions — 9 serious security bugs in the ready-made packages your project uses. The full picture — how your code is built, AI-generated-code risk, privacy, and 11 more areas — needs Audit.

9 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.

83 of 111 files scanned (74%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this meansWhat this means for youWhat this means

Two scanners read 83 of 111 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 9 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Packages you ship with known vulnerabilities

9 found · 8 packages

cvenpm brace-expansion2 in 1 version

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH

cvenpm body-parser@1.18.3GHSA-qwcr-r2fm-qrc7

body-parser vulnerable to denial of service when url encoding is enabled — HIGH

cvenpm braces@2.3.2GHSA-grv7-fg5c-xmjg

Uncontrolled resource consumption in braces — HIGH

cvenpm bson@1.0.9GHSA-v8w9-2789-6hhr

Deserialization of Untrusted Data in bson — CRITICAL

cvenpm decode-uri-component@0.2.0GHSA-w573-4hg7-7wgq

decode-uri-component vulnerable to Denial of Service (DoS) — HIGH

cvenpm fsevents@1.2.9GHSA-8r6j-v8pm-fqw3

Code injection in fsevents — CRITICAL

cvenpm i@0.3.6GHSA-x55w-vjjp-222r

inflect vulnerable to Inefficient Regular Expression Complexity — HIGH

cvenpm ini@1.3.5GHSA-qqgx-2p2h-9c37

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse — HIGH

Worth knowing, not blocking

36 found · 26 packages · 28 devDependencies

Test/example/doc credentials and devDependency or moderate/low CVEs. Surfaced as context — these never force the worst verdict.Passwords found in test, example or documentation files, and lower-severity security bugs in packages only used while building the project. Shown for context — these never cause the worst possible result.Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

dev depnpm grunt3 in 1 version

1.0.3 — GHSA-j383-35pm-c5h4, GHSA-m5pj-vjjf-4m3h, GHSA-rm36-94g8-835r

Path Traversal in Grunt — devDependency

Arbitrary Code Execution in grunt — devDependency

Race Condition in Grunt — devDependency

dev depnpm js-yaml3 in 1 version

3.5.5 — GHSA-2pr6-76vf-7546, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

Denial of Service in js-yaml — devDependency

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

dev depnpm adm-zip2 in 1 version

0.4.4 — GHSA-3v6h-hqm4-2rg6, GHSA-xcpc-8h2w-3j85

Arbitrary File Write in adm-zip — devDependency

adm-zip: Crafted ZIP file triggers 4GB memory allocation — devDependency

dev depnpm ajv2 in 1 version

6.10.0 — GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw

ajv has ReDoS when using `$data` option — devDependency

Prototype Pollution in Ajv — devDependency

dev depnpm diff2 in 1 version

1.4.0 — GHSA-73rr-hh4g-fpgx, GHSA-h6ch-v84p-w6p9

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch — devDependency

Regular Expression Denial of Service (ReDoS) — devDependency

low cvenpm express2 in 1 version

4.16.4 — GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc

express vulnerable to XSS via response.redirect() — LOW

Express.js Open Redirect in malformed URLs — MODERATE

dev depnpm form-data2 in 1 version

2.1.4 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx

form-data uses unsafe random function in form-data for choosing boundary — devDependency

form-data: CRLF injection in form-data via unescaped multipart field names and filenames — devDependency

dev depnpm hoek2 in 1 version

2.16.3 — GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm

hoek subject to prototype pollution via the clone function. — devDependency

Prototype Pollution in hoek — devDependency

dev depnpm async@2.6.1GHSA-fwr7-v2mv-hh25

Prototype Pollution in async — devDependency

dev depnpm bl@1.0.3GHSA-pp7h-53gx-mx7r

Remote Memory Exposure in bl — devDependency

low cvenpm body-parser@1.18.3GHSA-v422-hmwv-36x6

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW

moderate cvenpm brace-expansion@1.1.11GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE

moderate cvenpm bson@1.0.9GHSA-4jwp-vfvf-657p

Deserialization of Untrusted Data in bson — MODERATE

low cvenpm cookie@0.3.1GHSA-pxg6-pf52-xh8x

cookie accepts cookie name, path, and domain with out of bounds characters — LOW

dev depnpm cross-spawn@4.0.2GHSA-3xgq-45jj-v275

Regular Expression Denial of Service (ReDoS) in cross-spawn — devDependency

dev depnpm dot-prop@4.2.0GHSA-ff7x-qrg7-qggm

dot-prop Prototype Pollution vulnerability — devDependency

dev depnpm extract-zip@1.6.7GHSA-jmr9-qjv8-65gv

extract-zip unvalidated symlink path traversal — devDependency

advisory cvenpm fsevents@1.2.9MAL-2023-462

Malicious code in fsevents (npm) — UNKNOWN

dev depnpm getobject@0.1.0GHSA-957j-59c2-j692

Prototype pollution in getobject — devDependency

dev depnpm got@6.7.1GHSA-pfrx-2q88-qq97

Got allows a redirect to a UNIX socket — devDependency

dev depnpm growl@1.9.2GHSA-qh2h-chj9-jffq

Growl before 1.10.0 vulnerable to Command Injection — devDependency

dev depnpm hawk@3.1.3GHSA-44pw-h2cw-w3vq

Uncontrolled Resource Consumption in Hawk — devDependency

moderate cvenpm helmet-csp@1.2.2GHSA-c3m8-x3cg-qm2c

Configuration Override in helmet-csp — MODERATE

dev depnpm hosted-git-info@2.7.1GHSA-43f8-2h32-f4cj

Regular Expression Denial of Service in hosted-git-info — devDependency

dev depnpm json-schema@0.2.3GHSA-896r-f27r-55mw

json-schema is vulnerable to Prototype Pollution — devDependency

dev depnpm jsonpointer@4.0.1GHSA-282f-qqgm-c34q

Prototype Pollution in node-jsonpointer — devDependency

AI audit for OWASP/NodeGoat · all 14 dimensions · usually within 15 minutes*AI check for OWASP/NodeGoat · all 14 areas · usually within 15 minutes*AI audit · OWASP/NodeGoat · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inNeeds a free sign-in with GitHub or GoogleNeeds a free GitHub or Google sign-inThe free scan stays unlimitedYou can run the free scan as many times as you likeThe free scan stays unlimited

14 things we haven't looked at yet14 things we haven't checked yet14 things unaudited

Security logic, privacy, reliability, AI-generated-code risk and 10 more — unaudited, not clean.Security logic, privacy, reliability, AI-generated-code risk and 10 more — not checked yet, which is different from safe.Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan reasons across none of these. Absence of findings is reported as unaudited, not safe. Opus 4.8 reads the code semantically and scores every one — with evidence, business impact, and a fix per finding.

The free scan doesn't look at any of these. If nothing is flagged here, that means it wasn't checked — not that it's safe. Opus 4.8 (the AI model behind the audit) reads and understands your code and scores every one of these — with evidence, the real-world impact, and a fix for each finding.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 83 of 111 files · OWASP/NodeGoat
Dependency manifests: 1 package root found, 1 scanned — package list truncated at the vulnerability-lookup limit.

README badgeBadge for your project's readme fileREADME badge

[![nittim](https://nittim.com/api/badge/OWASP/NodeGoat)](https://nittim.com)