OWASP/NodeGoat free scan: 45 vulnerable dependencies, 0 committed secrets

OWASP/NodeGoat ↗ · c5cb68a · Aug 21, 2026, 11:05 PM

Hard evidence: 9 issues need attention now.

Free scan · deterministic evidence only

9 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.

83 of 111 files scanned (74%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.

What this means

Two scanners read 83 of 111 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 9 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.

Read it:

Packages you ship with known vulnerabilities

9 found · 8 packages

cvenpm brace-expansion2 in 1 version

1.1.11 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg

brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH

brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH

cvenpm body-parser@1.18.3GHSA-qwcr-r2fm-qrc7

body-parser vulnerable to denial of service when url encoding is enabled — HIGH

cvenpm braces@2.3.2GHSA-grv7-fg5c-xmjg

Uncontrolled resource consumption in braces — HIGH

cvenpm bson@1.0.9GHSA-v8w9-2789-6hhr

Deserialization of Untrusted Data in bson — CRITICAL

cvenpm decode-uri-component@0.2.0GHSA-w573-4hg7-7wgq

decode-uri-component vulnerable to Denial of Service (DoS) — HIGH

cvenpm fsevents@1.2.9GHSA-8r6j-v8pm-fqw3

Code injection in fsevents — CRITICAL

cvenpm i@0.3.6GHSA-x55w-vjjp-222r

inflect vulnerable to Inefficient Regular Expression Complexity — HIGH

cvenpm ini@1.3.5GHSA-qqgx-2p2h-9c37

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse — HIGH

Worth knowing, not blocking

36 found · 26 packages · 28 devDependencies

Context only — test/example secrets, dev-only or moderate/low CVEs. Never verdict-forcing.

dev depnpm grunt3 in 1 version

1.0.3 — GHSA-j383-35pm-c5h4, GHSA-m5pj-vjjf-4m3h, GHSA-rm36-94g8-835r

Path Traversal in Grunt — devDependency

Arbitrary Code Execution in grunt — devDependency

Race Condition in Grunt — devDependency

dev depnpm js-yaml3 in 1 version

3.5.5 — GHSA-2pr6-76vf-7546, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj

Denial of Service in js-yaml — devDependency

js-yaml: YAML merge-key chains can force quadratic CPU consumption — devDependency

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported — devDependency

dev depnpm adm-zip2 in 1 version

0.4.4 — GHSA-3v6h-hqm4-2rg6, GHSA-xcpc-8h2w-3j85

Arbitrary File Write in adm-zip — devDependency

adm-zip: Crafted ZIP file triggers 4GB memory allocation — devDependency

dev depnpm ajv2 in 1 version

6.10.0 — GHSA-2g4f-4pwh-qvx6, GHSA-v88g-cgmw-v5xw

ajv has ReDoS when using `$data` option — devDependency

Prototype Pollution in Ajv — devDependency

dev depnpm diff2 in 1 version

1.4.0 — GHSA-73rr-hh4g-fpgx, GHSA-h6ch-v84p-w6p9

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch — devDependency

Regular Expression Denial of Service (ReDoS) — devDependency

low cvenpm express2 in 1 version

4.16.4 — GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc

express vulnerable to XSS via response.redirect() — LOW

Express.js Open Redirect in malformed URLs — MODERATE

dev depnpm form-data2 in 1 version

2.1.4 — GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx

form-data uses unsafe random function in form-data for choosing boundary — devDependency

form-data: CRLF injection in form-data via unescaped multipart field names and filenames — devDependency

dev depnpm hoek2 in 1 version

2.16.3 — GHSA-c429-5p7v-vgjp, GHSA-jp4x-w63m-7wgm

hoek subject to prototype pollution via the clone function. — devDependency

Prototype Pollution in hoek — devDependency

dev depnpm async@2.6.1GHSA-fwr7-v2mv-hh25

Prototype Pollution in async — devDependency

dev depnpm bl@1.0.3GHSA-pp7h-53gx-mx7r

Remote Memory Exposure in bl — devDependency

low cvenpm body-parser@1.18.3GHSA-v422-hmwv-36x6

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW

moderate cvenpm brace-expansion@1.1.11GHSA-f886-m6hf-6m8v

brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE

moderate cvenpm bson@1.0.9GHSA-4jwp-vfvf-657p

Deserialization of Untrusted Data in bson — MODERATE

low cvenpm cookie@0.3.1GHSA-pxg6-pf52-xh8x

cookie accepts cookie name, path, and domain with out of bounds characters — LOW

dev depnpm cross-spawn@4.0.2GHSA-3xgq-45jj-v275

Regular Expression Denial of Service (ReDoS) in cross-spawn — devDependency

dev depnpm dot-prop@4.2.0GHSA-ff7x-qrg7-qggm

dot-prop Prototype Pollution vulnerability — devDependency

dev depnpm extract-zip@1.6.7GHSA-jmr9-qjv8-65gv

extract-zip unvalidated symlink path traversal — devDependency

advisory cvenpm fsevents@1.2.9MAL-2023-462

Malicious code in fsevents (npm) — UNKNOWN

dev depnpm getobject@0.1.0GHSA-957j-59c2-j692

Prototype pollution in getobject — devDependency

dev depnpm got@6.7.1GHSA-pfrx-2q88-qq97

Got allows a redirect to a UNIX socket — devDependency

dev depnpm growl@1.9.2GHSA-qh2h-chj9-jffq

Growl before 1.10.0 vulnerable to Command Injection — devDependency

dev depnpm hawk@3.1.3GHSA-44pw-h2cw-w3vq

Uncontrolled Resource Consumption in Hawk — devDependency

moderate cvenpm helmet-csp@1.2.2GHSA-c3m8-x3cg-qm2c

Configuration Override in helmet-csp — MODERATE

dev depnpm hosted-git-info@2.7.1GHSA-43f8-2h32-f4cj

Regular Expression Denial of Service in hosted-git-info — devDependency

dev depnpm json-schema@0.2.3GHSA-896r-f27r-55mw

json-schema is vulnerable to Prototype Pollution — devDependency

dev depnpm jsonpointer@4.0.1GHSA-282f-qqgm-c34q

Prototype Pollution in node-jsonpointer — devDependency

AI audit · OWASP/NodeGoat · 14 dimensions · usually within 15 minutes*

Audit — your first Audit is free. After that, about $5.Needs a free GitHub or Google sign-inThe free scan stays unlimited

14 things unaudited

Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.

The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.

SecurityPriority: Core

Privacy & CompliancePriority: Core

Reliability & ResiliencePriority: Core

Code Quality & ArchitecturePriority: Important

AI / Vibe Coding RiskPriority: Important

Performance & ScalabilityPriority: Important

Infrastructure & DevOpsPriority: Important

Data LayerPriority: Important

Business & Product RiskPriority: Supporting

Developer ExperiencePriority: Supporting

Accessibility & UXPriority: Supporting

ObservabilityPriority: Supporting

Maintainability ForecastPriority: Specialized

IP & Novelty ExposurePriority: Specialized

Modules run (2)

Hardcoded Secret ScanDependency Vulnerability Scan

Hover a module for why it was selected. See every check nittim can run.

Scanned 83 of 111 files · OWASP/NodeGoat
Dependency manifests: 1 package root found, 1 scanned — package list truncated at the vulnerability-lookup limit.

README badge

[![nittim](https://nittim.com/api/badge/OWASP/NodeGoat)](https://nittim.com/library/OWASP/NodeGoat)