List Node.js vulnerabilities

Lists known npm package vulnerabilities detected on a Node.js website, enriched with advisory metadata (severity, CVSS score, CVE, advisory URL).

List Node.js vulnerabilities

get

Lists known npm package vulnerabilities detected on a Node.js website, enriched with advisory metadata (severity, CVSS score, CVE, advisory URL). Results are sorted from the most severe to the least severe, then by publish date (newest first). Use the severities query parameter to filter.

Vulnerabilities with is_patchable set to true can be auto-fixed via the Patch Node.js Vulnerabilities endpoint, which opens a GitHub pull request with updated package versions. Auto-fix is only available for websites deployed from a connected GitHub repository. Vulnerabilities with is_patching_in_progress set to true are already included in an open patch pull request; while any patch pull request is open, new patch requests for this website are rejected until it is merged or closed.

Data comes from periodic dependency scans, so it may lag behind the latest deployment. An empty list means the most recent scan found no vulnerabilities; it does not guarantee the current deployment is vulnerability-free. Available on Business and Cloud Hosting plans.

Authorizations

AuthorizationstringRequired

API Token authentication

Path parameters

usernamestringRequiredExample: u123456789

domainstringRequired

Domain name

Example: mydomain.tld

Query parameters

Responses

200

Success response

application/json

Array of Hosting.V1.NodeJs.VulnerabilityResource

package_namestringOptional

Name of the affected npm package

Example: lodash

installed_versionstringOptional

Version of the package currently installed

Example: 4.17.0

is_directbooleanOptional

Whether the package is a direct dependency

Example: true

is_patchablebooleanOptional

Whether the vulnerability can be auto-patched without a major version bump

Example: true

fix_versionstring · nullableOptional

Version that fixes the vulnerability, if known

Example: 4.17.21

vulnerability_idstringOptional

Unique vulnerability identifier (e.g. GHSA or CVE)

Example: GHSA-jf85-cpcp-j695

severitystring · enumOptional

Severity level of the vulnerability

Example: highPossible values:

titlestringOptional

Short human-readable title of the vulnerability

Example: Prototype Pollution in lodash

descriptionstring · nullableOptional

Detailed description of the vulnerability

Example: Versions of lodash prior to 4.17.11 are vulnerable to prototype pollution.

cvss_scorenumber · float · nullableOptional

CVSS base score (0.0-10.0)

Example: 9.8

cvestring · nullableOptional

CVE identifier, if available

Example: CVE-2019-10744

cwestring · nullableOptional

CWE identifier describing the weakness type

Example: CWE-1321

urlstring · nullableOptional

URL to the vulnerability advisory

Example: https://github.com/advisories/GHSA-jf85-cpcp-j695

published_atstring · date-time · nullableOptional

Date the vulnerability was published, in ISO 8601 format

Example: 2019-07-26T00:00:00Z

is_patching_in_progressbooleanOptional

Whether this vulnerability is included in a currently open patch pull request

Example: false

401

Unauthenticated response

application/json

500

Error response

application/json

get/api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities

GET /api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities HTTP/1.1
Host: developers.hostinger.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "package_name": "lodash",
    "installed_version": "4.17.0",
    "is_direct": true,
    "is_patchable": true,
    "fix_version": "4.17.21",
    "vulnerability_id": "GHSA-jf85-cpcp-j695",
    "severity": "high",
    "title": "Prototype Pollution in lodash",
    "description": "Versions of lodash prior to 4.17.11 are vulnerable to prototype pollution.",
    "cvss_score": 9.8,
    "cve": "CVE-2019-10744",
    "cwe": "CWE-1321",
    "url": "https://github.com/advisories/GHSA-jf85-cpcp-j695",
    "published_at": "2019-07-26T00:00:00Z",
    "is_patching_in_progress": false
  }
]