scan.now
Premium Scan a site

Find Outdated and Vulnerable JavaScript Libraries on a Page

Loads a page, lists every JavaScript library it uses, and matches versions against the Retire.js vulnerability repository: each CVE with its severity and the version that fixes it.

Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use

Illustration of the javascript library vulnerability scanner in use

How it works

  1. Enter the page URL

    Script tags are collected from the HTML.

  2. Libraries are identified

    By URL patterns, filenames and, when needed, version strings inside the script itself.

  3. CVEs are listed per library

    Sorted by severity, with the safe version to upgrade to.

What this tool checks

10 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.

Full reference

Page content and JavaScript

10 checks

The ones that most often decide the grade:

High Mixed content (HTTP resources on an HTTPS page)The HTTPS page loads scripts, styles, frames or media over plain HTTP. Active mixed content is blocked by browsers... High Form submits over HTTPA form on the page submits to a plain-HTTP URL. Whatever the user types, including passwords and card numbers,... Low Third-party scripts without Subresource IntegrityScripts or stylesheets are loaded from third-party hosts without an integrity attribute. If that host is compromised... High JavaScript library with known vulnerabilitiesThe page loads a JavaScript library version with published vulnerabilities. Whether it is exploitable depends on how... Low CMS / generator version disclosureThe page announces the CMS or static-site generator it was built with, usually including the version, in a meta tag,... Info Third-party script inventoryAn inventory of every script the page loads from other domains. This is informational, but each host on the list...

After this one, most people run Website Scanner, SSL / TLS Checker, or Security Headers. Each answers a different question about the same thing, and the full list of tools explains which to reach for when. Every finding links through to the checks reference.

Guides for this tool

Background reading written to go with these results.

8 min read · Updated Sep 20, 2026 Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them

A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...

Read the guide 8 min read · Updated Sep 02, 2026 Subresource Integrity (SRI): Protecting Your Site From a Compromised CDN

When a page loads a script from a CDN, it trusts that CDN completely. Subresource Integrity pins the script to a hash so a tampered file...

Read the guide 9 min read · Updated Sep 16, 2026 CVE and CVSS Explained: How Vulnerabilities Are Named, Scored and Prioritised

Every public vulnerability gets a CVE identifier and usually a CVSS score. How the numbering works, what the score measures and does...

Read the guide 8 min read · Updated Sep 19, 2026 Cross-Site Scripting (XSS) Explained: Reflected, Stored, DOM-Based and How to Prevent It

XSS lets an attacker run their own script in your users' browsers. The three types, what an attacker does with it and the layered...

Read the guide

Frequently asked questions

Where does the vulnerability data come from?

The Retire.js repository, an open-source, community-maintained list of JavaScript libraries with known vulnerabilities, refreshed daily.

A library is flagged but I cannot upgrade it. What now?

Check whether the CVE affects a feature you use, add a strict Content-Security-Policy to limit the impact, and plan the upgrade. Some findings are avoidable without upgrading, most are not.

Why was a library missed?

Bundled and renamed libraries lose the filename and URL patterns we match. We also read version strings inside the first part of each script, but heavily minified bundles can hide them.