Loading report…
← nittim
← nittimshared scan
expressjs/express ↗ · 4f0f6cc · Aug 21, 2026, 11:34 PM
Hard evidence: 4 issues need attention now.
Free scan · deterministic evidence only
4 critical dependency vulnerabilities found. 11 more dimensions need Audit for the full picture.
190 of 231 files scanned (82%). Nothing was cut short by a limit — the rest is mostly images, generated output, and other non-source content this audit doesn't read.
What this means
Two scanners read 190 of 231 files: one for committed credentials, one for known vulnerabilities in your dependencies. They found 0 committed credentials on production paths and 4 high or critical vulnerabilities in runtime dependencies. These two checks cover a narrow slice of what decides whether software is ready to ship. All 14 dimensions — architecture, privacy, reliability, AI-generated-code risk and the rest — are unexamined here. Deep AI is the tier that issues a verdict. This scan does not.
Read it:
Packages you ship with known vulnerabilities
cvenpm path-to-regexp3 in 1 version
0.1.7 — GHSA-37ch-88jc-xwx2, GHSA-9wv6-86v2-598j, GHSA-rhx6-c78j-4q9w
path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters — HIGH
path-to-regexp outputs backtracking regular expressions — HIGH
path-to-regexp contains a ReDoS — HIGH
cvenpm body-parser@1.20.2GHSA-qwcr-r2fm-qrc7
body-parser vulnerable to denial of service when url encoding is enabled — HIGH
Worth knowing, not blocking
dev depnpm marked2 in 1 version
0.7.0 — GHSA-5v2h-r2cx-5xgj, GHSA-rrrm-qjm4-v8hf
Inefficient Regular Expression Complexity in marked — devDependency
Inefficient Regular Expression Complexity in marked — devDependency
low cvenpm qs2 in 1 version
6.11.0 — GHSA-6rw7-vpxm-498p, GHSA-w7fw-mjwx-w883
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion — MODERATE
qs's arrayLimit bypass in comma parsing allows denial of service — LOW
low cvenpm body-parser@1.20.2GHSA-v422-hmwv-36x6
body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement — LOW
low cvenpm cookie@0.6.0GHSA-pxg6-pf52-xh8x
cookie accepts cookie name, path, and domain with out of bounds characters — LOW
dev depnpm ejs@3.1.9GHSA-ghr5-ch3p-vcr6
ejs lacks certain pollution protection — devDependency
dev depnpm morgan@1.10.0GHSA-4vj7-5mj6-jm8m
morgan vulnerable to Log Forging via unneutralized control characters in :remote-user — devDependency
low cvenpm send@0.18.0GHSA-m6fv-jmcg-4jfg
send vulnerable to template injection that can lead to XSS — LOW
low cvenpm serve-static@1.15.0GHSA-cm22-4g7w-348p
serve-static vulnerable to template injection that can lead to XSS — LOW
AI audit · expressjs/express · 14 dimensions · usually within 15 minutes*
14 things unaudited
Security, privacy, reliability, AI-generated-code risk, 10 more: unaudited, not clean.
The free scan doesn't reason across these — unaudited, not safe. Opus 4.8 scores each, with evidence, impact, and a fix.
SecurityPriority: Core
Privacy & CompliancePriority: Core
Reliability & ResiliencePriority: Core
Code Quality & ArchitecturePriority: Important
AI / Vibe Coding RiskPriority: Important
Performance & ScalabilityPriority: Important
Infrastructure & DevOpsPriority: Important
Data LayerPriority: Important
Business & Product RiskPriority: Supporting
Developer ExperiencePriority: Supporting
Accessibility & UXPriority: Supporting
ObservabilityPriority: Supporting
Maintainability ForecastPriority: Specialized
IP & Novelty ExposurePriority: Specialized
Modules run (2)
Hardcoded Secret ScanDependency Vulnerability Scan
Scanned 190 of 231 files · expressjs/express
Dependency manifests: 1 package root found, 1 scanned.
README badge
[](https://nittim.com/library/expressjs/express)