> For the complete documentation index, see [llms.txt](https://docs.hostinger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hostinger.com/node.js/vulnerabilities.md).

# Vulnerability Scanning

Hostinger scans the npm packages your Node.js app installs against known-vulnerability advisories and flags anything that needs patching. Find it under **Security** → **Vulnerabilities** in your website dashboard.

## When scans run

* **After every deployment** — each successful build records your dependency tree and scans it.
* **Periodically** — deployed apps are re-scanned on a regular schedule, so new advisories surface even without a deploy.

An app that hasn't been deployed since the feature was enabled shows "Not scanned yet — your next deployment will trigger a scan."

## What you see

The **Unpatched dependencies** table lists each affected package with:

* Package name and installed version
* Whether it's a **direct** dependency (in your `package.json`) or **transitive** (pulled in by another package)
* The version that fixes the issue
* Advisory ID (CVE), CVSS score, severity, and publish date

Severity levels: **critical**, **high**, **moderate**, **low** (and **unknown** when no score is available). Filter by severity or search by package name or CVE. Expand a row for details.

## Email notifications

When new vulnerabilities are found in your app, Hostinger emails you. Unchanged findings aren't re-notified more than once a week.

## Fixing vulnerabilities

### Git-deployed apps: Auto-fix pull requests

If your app deploys from a [connected GitHub repository](/node.js/github.md), select the vulnerabilities to fix and click **Auto-fix**:

1. Hostinger creates a **pull request on your GitHub repository** that bumps the affected packages to patched versions.
2. You review and merge it yourself — **nothing goes live until you merge**.
3. Merging triggers the usual auto-deployment, and the next scan confirms the fix.

The PR includes a table of each package, its old and new version, and the advisory it addresses. After merging, run an install locally to refresh your lockfile if you work on the project elsewhere.

Auto-fix requires an active GitHub connection — if the button is disabled with "GitHub is not connected", reconnect first.

### Archive-deployed apps: manual patching

Update the flagged packages in your project (`npm update <package>` or bump the version in `package.json`), rebuild your archive, and redeploy via **Deployments** → **Deployment settings**.

## Related

* [GitHub](/node.js/github.md) — connecting a repository
* [Deployments](/node.js/deployments.md) — redeploying after a fix

***

*Last updated: July 22, 2026*