Loading report…
← nittim
← nittimshared scan
date-fns/date-fns ↗ · a0a3922 · Aug 21, 2026, 10:49 PM
Hard evidence: 11 issues need attention now.
Free scan · deterministic evidence only
11 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
500 of 1903 files scanned (26%) — this snapshot was truncated: this audit's size limit was reached, so some source was left unread.
What this means
Two scanners read 500 of 1903 files, starting with the highest-priority ones: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 11 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep Verification is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm brace-expansion7 in 3 versions
1.1.12 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
2.0.2 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
5.0.6 — GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895
brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups — HIGH
brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash — HIGH
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation — HIGH
cvenpm @grpc/grpc-js2 in 1 version
1.13.4 — GHSA-5375-pq7m-f5r2, GHSA-99f4-grh7-6pcq
@grpc/grpc-js: A malformed request can cause a server crash — HIGH
@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash — HIGH
cvenpm @isaacs/brace-expansion@5.0.0GHSA-7h2j-956f-4vf2
@isaacs/brace-expansion has Uncontrolled Resource Consumption — HIGH
cvenpm fast-xml-parser@4.5.3GHSA-8gc5-j5rx-235r
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) — HIGH
Worth knowing, not blocking
dev depnpm lodash3 in 1 version
4.17.21 — GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` — devDependency
lodash vulnerable to Code Injection via `_.template` imports key names — devDependency
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions — devDependency
dev depnpm minimatch3 in 1 version
10.0.3 — GHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions — devDependency
minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern — devDependency
minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments — devDependency
dev depnpm simple-git3 in 1 version
2.48.0 — GHSA-28xr-mwxg-3qc8, GHSA-3f95-r44v-8mrg, GHSA-9p95-fxvg-qgq2
Command injection in simple-git — devDependency
Command injection in simple-git — devDependency
simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol — devDependency
dev depnpm @vitest/browser2 in 1 version
4.1.6 — GHSA-g8mr-85jm-7xhm, GHSA-p63j-vcc4-9vmv
Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE — devDependency
@vitest/browser: Browser Mode provider commands bypass the file-access permission gate — devDependency
moderate cvenpm brace-expansion2 in 2 versions
1.1.12 — GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
2.0.2 — GHSA-f886-m6hf-6m8v
brace-expansion: Zero-step sequence causes process hang and memory exhaustion — MODERATE
low cvenpm fast-xml-parser2 in 1 version
4.5.3 — GHSA-fj3w-jwp8-x2g3, GHSA-gh4j-gqv2-49f6
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder — LOW
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters — MODERATE
dev depnpm glob2 in 2 versions
10.4.5 — GHSA-5j98-mcp5-4vw2
glob CLI: Command injection via -c/--cmd executes matches with shell:true — devDependency
11.0.3 — GHSA-5j98-mcp5-4vw2
glob CLI: Command injection via -c/--cmd executes matches with shell:true — devDependency
dev depnpm @babel/core@7.28.0GHSA-4x5r-pxfx-6jf8
@babel/core: Arbitrary File Read via sourceMappingURL Comment — devDependency
moderate cvenpm @octokit/request@5.6.3GHSA-rmvr-2pp2-xj38
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking — MODERATE
moderate cvenpm @octokit/request-error@2.1.0GHSA-xx4v-prfh-6cgc
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking — MODERATE
moderate cvenpm @protobufjs/utf8@1.1.0GHSA-q6x5-8v7m-xcrf
protobufjs has overlong UTF-8 decoding — MODERATE
low cvenpm @tootallnate/once@2.0.0GHSA-vpq2-c234-7xj6
@tootallnate/once vulnerable to Incorrect Control Flow Scoping — LOW
moderate cvenpm ajv@6.12.6GHSA-2g4f-4pwh-qvx6
ajv has ReDoS when using `$data` option — MODERATE
low cvenpm esbuild@0.28.0GHSA-g7r4-m6w7-qqqr
esbuild allows arbitrary file read when running the development server on Windows — LOW
dev depnpm firebase@3.9.0GHSA-3wf4-68gx-mph8
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server — devDependency
AI audit · date-fns/date-fns · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 500 of 1903 files (highest-priority subset) · date-fns/date-fns
Dependency manifests: 28 package roots found, 15 scanned — package list truncated at the vulnerability-lookup limit.
README badge
[](https://nittim.com/library/date-fns/date-fns)