Skip to content

How to find and update vulnerable JavaScript libraries

Best practices1 min readFixes check js-library-vulnerable

An old jQuery, Bootstrap or Lodash on your pages has published attacks anyone can copy. Check which versions load, update to the fixed release and remove copies plugins bundle on their own.

Check your own site

Runs this check and the other 186, free, in about 45 seconds.

What a passing site looks like

  • No known security holes in the JavaScript libraries we could identifyfail · −5 ptseffort M

Vulnerable JavaScript libraries

Why it matters. Old library versions have published attacks that anyone can copy, most often cross-site scripting. Attackers scan for them automatically, and security reviews and some insurers flag them.

How to fix it.
  1. Update each library to at least the fixed version in the technical detail; on WordPress, update the theme and plugins that bundle it.
  2. For jQuery on WordPress, remove plugins that load their own old copy instead of the one WordPress ships.
  3. If a library is no longer needed, remove it; Moment.js and AngularJS are end-of-life, so plan a replacement.

Filed under Security. Copy is generated from the same catalogue that scores every report, so what you read here is what the report says.