CVE Scanning for JavaScript Apps: Finding Known Vulnerabilities with Trivy

What We Found in 963 Codebases

These numbers come from VibeDoctor's own scans, which run Trivy on every codebase. No project or owner is identified here.

Projects connected to a VibeDoctor account looked better. Of 336 such projects, as of each one's most recent scan (May to October 2026):

A project with CVEs had a median of 6.5 of them; the worst had 88. These packages showed up most often in critical and high findings:

Several of these are rarely installed on purpose. form-data comes in with axios, and minimatch and picomatch with build tooling. You will not see them in your package.json, only in your lockfile, which is why a scanner has to read the lockfile.

What Is a CVE and Why Should You Care?

A CVE (Common Vulnerabilities and Exposures) is a publicly disclosed security flaw in a specific piece of software. When a bug such as a path traversal in an upload library or a prototype pollution issue in a utility package is found, it gets an identifier like CVE-2024-21538 and a severity score (CVSS) from 0 to 10.

Vibe-coded apps are exposed by volume. When Bolt, Lovable or Cursor scaffolds a project it installs dozens of packages, and each of those brings its own dependencies. Your lockfile lists far more packages than your package.json, and any of them can carry a known CVE.

npm audit or Trivy?

npm audit is built into npm and is the quickest check for an npm-only project. Trivy covers more ground with one tool and one report:

If your app has a Python worker, a Go service or a Dockerfile next to the JavaScript, Trivy checks all of it in one pass.

Installing and Running Trivy

# Install Trivy (macOS)
brew install trivy

# Install Trivy (Linux / WSL)
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin

# Scan a project directory
trivy fs --scanners vuln .

# Show every severity
trivy fs --scanners vuln --severity LOW,MEDIUM,HIGH,CRITICAL .

# Only HIGH and CRITICAL, failing the command if any are found (for CI)
trivy fs --scanners vuln --severity HIGH,CRITICAL --exit-code 1 .

# JSON output for other tools
trivy fs --scanners vuln --format json --output trivy-report.json .

The --exit-code 1 flag makes Trivy return a non-zero exit code when it finds vulnerabilities, which fails a CI build. That is how you enforce "no HIGH or CRITICAL CVEs reach production".

What a Trivy Report Looks Like

Example output for a Next.js app, trimmed to the main columns:

package-lock.json (npm)
Total: 23 (LOW: 4, MEDIUM: 11, HIGH: 6, CRITICAL: 2)

Library          Vulnerability    Severity  Status  Title
axios            CVE-2024-39338   HIGH      fixed   axios: axios: Server-Side Request Forgery
next             CVE-2024-46982   HIGH      fixed   Next.js Cache Poisoning
path-to-regexp   CVE-2024-45296   HIGH      fixed   path-to-regexp: Backtracking regular expressions cause ReDoS
cross-spawn      CVE-2024-21538   HIGH      fixed   cross-spawn: regular expression denial of service

"fixed" in the Status column means a patched version exists, so the fix is a package update away. The full table also shows the installed and fixed versions.

How to Fix CVEs Found by Trivy

# Update a direct dependency within its allowed range
npm update axios

# Let npm fix what it can, including transitive dependencies
npm audit fix

# Major-version upgrades need a manual install and testing
npm install next@latest

# Re-scan to confirm
trivy fs --scanners vuln --severity HIGH,CRITICAL .

Transitive packages like ws or form-data are fixed by updating the package that pulls them in. When that package has no release yet, npm's overrides field in package.json (Yarn calls it resolutions; pnpm 11 and later read overrides from pnpm-workspace.yaml) forces a patched version:

{
  "overrides": {
    "form-data": "^4.0.4"
  }
}

Check the CVE's advisory for the right version, run your tests, and remove the override once the parent package catches up. If npm audit fix says "fix available via --force", read the changelog first: it usually means a major version bump with breaking changes.

Adding Trivy to Your CI/CD Pipeline

# .github/workflows/security.yml
name: Security Scan
on: [push, pull_request]

jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          scan-type: 'fs'
          scan-ref: '.'
          scanners: 'vuln'
          severity: 'HIGH,CRITICAL'
          exit-code: '1'

This fails any pull request that introduces a HIGH or CRITICAL vulnerability. The action is pinned to a full commit SHA, not a tag or @master, so a change upstream cannot alter your pipeline. That is not theoretical: in March 2026 attackers force-pushed almost all of trivy-action's version tags to credential-stealing commits, and Aqua's own advice is to pin GitHub Actions to full commit SHAs.

How VibeDoctor Scans for CVEs

VibeDoctor's Vibe Check runs Trivy on the lockfiles in your repository (npm, Yarn, pnpm, Python, Go, Rust, PHP, Ruby and more) on every codebase scan. Each CVE is listed with the package, the installed version and its severity, in the same Security Issues section as leaked secrets. Free to sign up.

FAQ