Reachability Analysis
Reachability analysis is a technique for determining whether a vulnerable code path in a dependency is actually reachable from your application's code. A library might have a Critical CVE, but if your application never calls the vulnerable function, you're not actually exposed. Reachability analysis filters out those false positives.
Why it matters in practice
Most dependency scanners flag every CVE in every package you install. A typical scan on a medium-sized application can return 50-200 vulnerabilities. The vast majority are in code paths your application never touches. Reachability analysis cuts through the noise by tracing your actual call graph.
For example: a popular HTTP library might have a CVE in its WebSocket implementation. If your application uses the library only for plain HTTP requests and never uses WebSockets, the CVE is technically present but not reachable. A reachability-aware scanner won't flag it — or will flag it with lower priority.
How it works
Reachability analysis tools construct a call graph — a map of which functions call which other functions across your codebase and its dependencies. They then check whether any path from your application's entry points reaches the vulnerable function identified in the CVE.
This requires static analysis of your actual source code, not just your manifest file. It's why reachability analysis is typically a feature of enterprise SCA platforms (Snyk Code, Endor Labs, Aikido) rather than quick browser-based tools.
The trade-off
Reachability analysis reduces false positives significantly — some studies show it eliminates 70-80% of flagged CVEs as unreachable. The downside is it requires more setup: you need to give the tool access to your source code, and analysis takes longer than a simple manifest scan.
For most teams: start with manifest scanning (PackageFix, npm audit, OSV Scanner) to fix the clear issues. Add reachability analysis when alert fatigue becomes a problem — when you're drowning in Medium CVEs that are hard to prioritize.
Paste your manifest — see your exact versions against the full CVE history.
Scan with PackageFix →Free · No signup · No CLI · Runs in your browser