← Back to packages

Real saved report · no signup required

D

Express

npm · express

64.1

Health score /100

Low issue resolution

Daily monitoring ·

Some data sources were unavailable during this scan. Findings may be incomplete.

Upstream repository: expressjs/express ↗

Grades measure upstream repository maintenance health, not the security of a specific installed version. Security findings below concern the dependencies inspected in that repository; coverage may be incomplete.

Maintenance breakdown

Resolution

45/100

  • Low issue resolution

    Close rate: 46%.

  • Recent activity

    29 issues closed in the last 30 days.

    View evidence ↗

Risk Flags

93/100

Backlog Health

100/100

  • Healthy backlog

    Only 0% of open issues are older than 6 months.

Responsiveness

40/100

Score history

Scan completed (UTC)GradeHealth score
D64.1
C71.5
C71.5
C71.5
C71.5
C71.5
C77.5
B82.1
C76.1
C76.1
C77.5
C77.5
C77.5
B83.5
C77.5
C77.5
C77.5
C77.5
D65.5
C71.5

Security findings

body-parser ^2.4.0

  • body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    high · CVE-2026-111181

    View advisory ↗

  • body-parser vulnerable to denial of service when url encoding is enabled

    high · CVE-2024-45590

    View advisory ↗

  • body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

    low · CVE-2026-12590

    View advisory ↗

  • body-parser is vulnerable to denial of service when url encoding is used

    medium · CVE-2025-13466

    View advisory ↗

cookie ^0.7.1

  • cookie accepts cookie name, path, and domain with out of bounds characters

    low · CVE-2024-47764

    View advisory ↗

cookie-signature ^1.2.1

debug ^4.4.0

  • debug Inefficient Regular Expression Complexity vulnerability

    high · CVE-2017-20165

    View advisory ↗

  • Regular Expression Denial of Service in debug

    low · CVE-2017-16137

    View advisory ↗

  • Malicious code in debug (npm)

    unknown · CVE-2025-59144

    View advisory ↗

fresh ^2.0.0

  • Regular Expression Denial of Service in fresh

    high · CVE-2017-16119

    View advisory ↗

proxy-addr ^2.0.8

  • proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

    critical · CVE-2026-90711

    View advisory ↗

qs ^6.16.0

  • qs: Denial of Service via Attacker Controlled isBuffer

    medium · CVE-2026-82417

    View advisory ↗

  • qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)

    medium · CVE-2026-110816

    View advisory ↗

  • qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion

    low · CVE-2025-15284

    View advisory ↗

  • Denial-of-Service Extended Event Loop Blocking in qs

    high · CVE-2014-10064

    View advisory ↗

  • Prototype Pollution Protection Bypass in qs

    high · CVE-2017-1000048

    View advisory ↗

  • qs vulnerable to Prototype Pollution

    high · CVE-2022-24999

    View advisory ↗

  • Denial-of-Service Memory Exhaustion in qs

    high · CVE-2014-7191

    View advisory ↗

  • qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set

    medium · CVE-2026-8723

    View advisory ↗

  • qs's arrayLimit bypass in comma parsing allows denial of service

    low · CVE-2026-2391

    View advisory ↗

  • qs array-limit bypass via bracket-key comma parsing

    low · CVE-2026-82562

    View advisory ↗

send ^1.1.0

serve-static ^2.2.0

  • Open Redirect in serve-static

    low · CVE-2015-1164

    View advisory ↗

  • serve-static vulnerable to template injection that can lead to XSS

    low · CVE-2024-43800

    View advisory ↗

Healthier alternatives

Check your dependencies Check your dependencies

We check this public collection daily. You can scan your own dependencies for free.