Repo check
owasp/nodegoat
In plain English
owasp/nodegoat scores F (0/100). The biggest issue: private key committed to the repo (plus 28 more).
Private key committed to the repo
A private key is in the public code. Anyone can copy it and impersonate the server or service it belongs to.
How to fix: Treat the key as leaked: replace it, revoke the old one, and load keys from a secrets store. Deleting the file is not enough, since old commits keep it.
----...(31 chars) in artifacts/cert/server.key:1
bson@1.0.9 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update bson to 1.1.4 or later and commit the updated package-lock.json.
CVE-2019-2391, CVE-2020-7610 (package-lock.json)
form-data@2.3.3 has known vulnerabilities
2 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update form-data to 2.5.6 or later and commit the updated package-lock.json.
CVE-2025-7783, CVE-2026-12143 (package-lock.json)
form-data@2.1.4 has known vulnerabilities
2 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update form-data to 2.5.6 or later and commit the updated package-lock.json.
CVE-2025-7783, CVE-2026-12143 (package-lock.json)
fsevents@1.2.9 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update fsevents to 1.2.11 or later and commit the updated package-lock.json.
CVE-2023-45311, MAL-2023-462 (package-lock.json)
getobject@0.1.0 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update getobject to 1.0.0 or later and commit the updated package-lock.json.
CVE-2020-28282 (package-lock.json)
minimist@1.2.0 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update minimist to 1.2.6 or later and commit the updated package-lock.json.
CVE-2020-7598, CVE-2021-44906 (package-lock.json)
minimist@0.0.8 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update minimist to 0.2.4 or later and commit the updated package-lock.json.
CVE-2020-7598, CVE-2021-44906 (package-lock.json)
tar@4.4.8 has known vulnerabilities
18 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update tar to 7.5.21 or later and commit the updated package-lock.json.
CVE-2026-59873, CVE-2026-24842, CVE-2021-32804 (+15 more) (package-lock.json)
adm-zip@0.4.4 has known vulnerabilities
8 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update adm-zip to 0.6.1 or later and commit the updated package-lock.json.
CVE-2018-1002204, CVE-2026-77301, CVE-2026-114102 (+5 more) (package-lock.json)
ansi-regex@3.0.0 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update ansi-regex to 3.0.1 or later and commit the updated package-lock.json.
CVE-2021-3807 (package-lock.json)
async@2.6.1 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update async to 2.6.4 or later and commit the updated package-lock.json.
CVE-2021-43138 (package-lock.json)
body-parser@1.18.3 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update body-parser to 1.20.6 or later and commit the updated package-lock.json.
CVE-2024-45590, CVE-2026-12590 (package-lock.json)
brace-expansion@1.1.11 has known vulnerabilities
8 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update brace-expansion to 1.1.21 or later and commit the updated package-lock.json.
CVE-2026-13149, CVE-2026-102276, CVE-2026-33750 (+5 more) (package-lock.json)
braces@2.3.2 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update braces to 3.0.3 or later and commit the updated package-lock.json.
CVE-2024-4068, CVE-2026-93687 (package-lock.json)
cross-spawn@7.0.3 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update cross-spawn to 7.0.5 or later and commit the updated package-lock.json.
CVE-2024-21538 (package-lock.json)
cross-spawn@4.0.2 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update cross-spawn to 6.0.6 or later and commit the updated package-lock.json.
CVE-2024-21538 (package-lock.json)
cross-spawn@6.0.5 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update cross-spawn to 6.0.6 or later and commit the updated package-lock.json.
CVE-2024-21538 (package-lock.json)
cross-spawn@5.1.0 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update cross-spawn to 6.0.6 or later and commit the updated package-lock.json.
CVE-2024-21538 (package-lock.json)
debug@2.2.0 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update debug to 2.6.9 or later and commit the updated package-lock.json.
CVE-2017-20165, CVE-2017-16137 (package-lock.json)
decode-uri-component@0.2.0 has known vulnerabilities
2 published security advisories affect this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update decode-uri-component to 0.5.0 or later and commit the updated package-lock.json.
CVE-2026-45822, CVE-2022-38900 (package-lock.json)
diff@1.4.0 has known vulnerabilities
2 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update diff to 3.5.1 or later and commit the updated package-lock.json.
CVE-2026-24001, GHSA-h6ch-v84p-w6p9 (package-lock.json)
dot-prop@4.2.0 has known vulnerabilities
One published security advisory affects this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update dot-prop to 4.2.1 or later and commit the updated package-lock.json.
CVE-2020-8116 (package-lock.json)
extract-zip@1.6.7 has known vulnerabilities
2 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update extract-zip to a fixed version and commit the updated package-lock.json.
CVE-2026-19693, CVE-2026-56876 (package-lock.json)
ini@1.3.5 has known vulnerabilities
One published security advisory affects this version. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update ini to 1.3.6 or later and commit the updated package-lock.json.
CVE-2020-7788 (package-lock.json)
js-yaml@3.6.1 has known vulnerabilities
7 published security advisories affect this version, though it is only used during development. Depending on how the project uses it, attackers may be able to take advantage.
How to fix: Update js-yaml to 3.15.2 or later and commit the updated package-lock.json.
CVE-2026-84375, GHSA-2pr6-76vf-7546, CVE-2026-59869 (+4 more) (package-lock.json)
89 more packages have known vulnerabilities
Only the first 25 vulnerable packages are listed one by one.
How to fix: Run your package manager's audit command (npm audit, composer audit, pip-audit) and update the flagged packages.
kind-of@6.0.2, minimatch@3.0.4, nconf@0.6.9, semver@5.7.0, tmp@0.1.0
No updates in over 2 years
Nothing has been pushed for about 2 years, so flaws in it or its dependencies are unlikely to be fixed.
How to fix: If you depend on it, check for a maintained fork or alternative. If you own it, update its dependencies.
last push 2024-06-15
No automatic dependency updates
Without Dependabot or Renovate, vulnerable packages stay in place until someone notices.
How to fix: Add .github/dependabot.yml (or a Renovate config) so update pull requests open automatically.
No security policy (SECURITY.md)
A SECURITY.md tells people how to report a vulnerability privately instead of posting it in a public issue.
How to fix: Add SECURITY.md with a contact address and which versions get fixes, or turn on GitHub's private vulnerability reporting.
Technical details (22)
- osv
- ok
- repo fork
- false
- repo forks
- 3049
- repo stars
- 2082
- repo license
- Apache-2.0
- repo archived
- false
- repo fullName
- OWASP/NodeGoat
- repo language
- HTML
- repo pushedAt
- 2024-06-15T01:20:40Z
- repo defaultBranch
- master
- files
- 111
- partial
- true
- timingMs
- 7073
- reachable
- true
- rawFetches
- 67
- secretScan candidates
- 66
- secretScan filesScanned
- 66
- secretScan testAndExampleFolders
- skipped
- githubCalls
- 2
- securityPolicy
- false
- packagesChecked
- 1000
- vulnerablePackages
- 114
This check is passive and automated: it reads only what a normal visit can see and can miss problems a full audit would find. A good grade is not a guarantee. If you run this site and something here is wrong, the fix steps are a starting point, not a substitute for your host or a security professional.