npm audit found high severity vulnerabilities

Fix 'npm audit found N vulnerabilities (M high severity)'. Get a patched package.json with all high severity CVEs resolved.

found 3 high severity vulnerabilities

Root Cause

One or more of your npm dependencies has a known HIGH or CRITICAL CVE. npm audit reports it but npm audit fix may not be able to resolve it without breaking changes.

How to Fix

1. Paste your package.json into PackageFix to get a live CVE scan with safe fix versions.
2. Review the severity badges — CRITICAL and HIGH packages on the CISA KEV catalog are flagged in red.
3. Download the fixed package.json and run npm install to regenerate package-lock.json.
4. For transitive vulnerabilities, use the npm overrides block PackageFix generates.

What npm audit high severity means

When npm audit reports a high severity vulnerability, it means one or more packages in your dependency tree have a CVSS score between 7.0 and 8.9. These vulnerabilities can often be exploited remotely and should be fixed within your next release cycle.

Why npm audit fix doesn't resolve it

The most common reason npm audit fix won't resolve a high severity vulnerability is that the fix requires a major version bump. npm audit fix only applies semver-compatible updates — it won't automatically upgrade from express@4 to express@5 because that could introduce breaking changes.

# See what npm audit fix would do
npm audit fix --dry-run

# Force major version upgrades (test thoroughly first)
npm audit fix --force

# See the full vulnerability tree
npm audit --json | head -100

Fixing transitive high severity vulnerabilities

If the vulnerable package is not in your package.json directly — it's pulled in by another package — npm audit fix cannot resolve it automatically. You have two options:

Option 1 — npm overrides (recommended)

// Add to package.json
{
  "overrides": {
    "vulnerable-package": "safe-version"
  }
}

// Then reinstall
npm install

Option 2 — Update the parent package

# Find which package pulls in the vulnerability
npm ls vulnerable-package

# Update the parent package that depends on it
npm install parent-package@latest

Common high severity npm packages and fixes

Scan your full manifest

npm audit only covers your lockfile. PackageFix checks all 7 ecosystems, flags CISA KEV actively exploited packages, and generates the exact npm overrides block for transitive vulnerabilities.