Enter the page URL
Script tags are collected from the HTML.
Find Outdated and Vulnerable JavaScript Libraries on a Page
Loads a page, lists every JavaScript library it uses, and matches versions against the Retire.js vulnerability repository: each CVE with its severity and the version that fixes it.
Public hosts only. About a handful of requests, usually finished in under 15 seconds. How we scan · Acceptable use
Scanning…
First results
The full scan is still running
How it works
Libraries are identified
By URL patterns, filenames and, when needed, version strings inside the script itself.
CVEs are listed per library
Sorted by severity, with the safe version to upgrade to.
What this tool checks
10 checks across 1 areas. Each links to its reference page with the test, the risk and the fix.
Page content and JavaScript
10 checksThe ones that most often decide the grade:
High
Mixed content (HTTP resources on an HTTPS page)The HTTPS page loads scripts, styles, frames or media over plain HTTP. Active mixed content is blocked by browsers...
High
Form submits over HTTPA form on the page submits to a plain-HTTP URL. Whatever the user types, including passwords and card numbers,...
Low
Third-party scripts without Subresource IntegrityScripts or stylesheets are loaded from third-party hosts without an integrity attribute. If that host is compromised...
High
JavaScript library with known vulnerabilitiesThe page loads a JavaScript library version with published vulnerabilities. Whether it is exploitable depends on how...
Low
CMS / generator version disclosureThe page announces the CMS or static-site generator it was built with, usually including the version, in a meta tag,...
Info
Third-party script inventoryAn inventory of every script the page loads from other domains. This is informational, but each host on the list...
Low
Advertising and tracking endpointsWhich of the page's third-party hosts exist to advertise to the visitor or to follow them, matched against the...
Info
Inline event handlers and scriptsThe page relies on inline scripts, on* event-handler attributes or javascript: URLs. These are not vulnerabilities...
Low
Sensitive information in HTML commentsHTML comments in the page source contain material that looks internal: Credentials, TODO notes, internal hostnames...
Info
Password field autocompletePassword fields on the page either try to disable autocomplete, which browsers ignore and password managers dislike,...
How vulnerable JavaScript libraries are detected
The scanner inventories scripts loaded by one page, extracts supported library versions and matches them with the Retire.js advisory database.
A JavaScript library can remain in a template long after the application stops using the feature that introduced it. If the library version has a known vulnerability, every page loading that asset carries the dependency even when the vulnerable function is not obviously visible.
Scan.now collects script URLs from the returned HTML and examines supported filenames, URL patterns and version strings inside the beginning of each accessible script. Detected versions are compared with Retire.js vulnerability ranges. The report identifies the library, evidence, advisory and fixed version without executing the script.
Fetch one pageRead the server-rendered HTML and its script references.
Identify librariesUse URLs, filenames and supported in-file version fingerprints.
Match CVEsCompare the detected version with known affected ranges.
Put this result in context
This scanner answers one part of the review. Continue with Website Scanner for headers, tls, cookies, exposed files, then LLM API Key Scanner for openai, anthropic, gemini and other ai keys. These are separate checks because a strong result here does not prove that the adjacent surface is healthy.
For the background behind these signals, read Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them and Subresource Integrity (SRI): Protecting Your Site From a Compromised CDN. The Mixed content (HTTP resources on an HTTPS page) check reference explains the exact test, evidence and remediation used in the report. The Scan.now methodology explains request limits, scan boundaries and what the scanner deliberately does not attempt.
JavaScript library scan evidence
A confident finding needs both a supported library fingerprint and a version that matches an advisory range.
| Signal | What it reveals | Common blind spot |
|---|---|---|
| Script filename | Names and versions such as library-1.2.3.min.js. | Renamed or fingerprint-hashed bundles can remove the recognisable name. |
| Asset URL | CDN paths, package directories and query-string versions. | A stale query value can disagree with the served file. |
| In-file signature | Library banners or embedded version constants in accessible code. | Minification and bundling can remove or transform the marker. |
| Advisory range | Whether the detected version is included in a known vulnerable range. | A CVE may affect only a feature the site does not use, which still requires review. |
| Fixed version | The first release outside the affected range when the advisory provides one. | Major upgrades can require compatibility testing before deployment. |
What the JavaScript result means
Inventory quality and vulnerability matching are reported separately.
No known affected version
No recognised library version on the scanned page matched the current advisory data.
Known vulnerable version
The detected version falls inside an advisory range. Review exploit conditions and plan the supported upgrade.
Unidentified bundle
The page loads JavaScript that cannot be mapped to a supported library and version. Absence of a match is not proof that the bundle is current.
Manage browser dependencies
- Upgrade to a supported release outside every matched vulnerable range.
- Remove libraries and plugins no longer used by the page.
- Pin dependencies in the build and use automated advisory checks before deployment.
- Use a restrictive Content-Security-Policy and Subresource Integrity where third-party scripts must remain.
What this result does not prove
- The scan does not execute JavaScript or discover assets loaded only after interaction.
- Custom, renamed or heavily bundled code may not expose a supported library fingerprint.
- A known CVE match shows applicable version evidence, not proof that an attacker exploited the site.
Related tools
Continue the review with four checks that cover adjacent parts of the same attack surface.
Website Vulnerability Scanner
Headers, TLS, cookies, exposed files
LLM API Key Exposure Scanner
OpenAI, Anthropic, Gemini and other AI keys
SSL / TLS Checker
Certificate, expiry, protocols, ciphers
Security Headers Checker
CSP, HSTS, frame and MIME policies
Guides for this tool
Background reading written to go with these results.
8 min read · Updated Sep 20, 2026
Outdated JavaScript Libraries: Why Old jQuery and Angular Are a Real Risk and How to Find Them
A page that ships an old library ships its known vulnerabilities. How Retire.js-style detection works, the most common vulnerable...
Read the guide
8 min read · Updated Sep 02, 2026
Subresource Integrity (SRI): Protecting Your Site From a Compromised CDN
When a page loads a script from a CDN, it trusts that CDN completely. Subresource Integrity pins the script to a hash so a tampered file...
Read the guide
9 min read · Updated Sep 16, 2026
CVE and CVSS Explained: How Vulnerabilities Are Named, Scored and Prioritised
Every public vulnerability gets a CVE identifier and usually a CVSS score. How the numbering works, what the score measures and does...
Read the guide
8 min read · Updated Sep 19, 2026
Cross-Site Scripting (XSS) Explained: Reflected, Stored, DOM-Based and How to Prevent It
XSS lets an attacker run their own script in your users' browsers. The three types, what an attacker does with it and the layered...
Read the guideFrequently asked questions
Where does the vulnerability data come from?
The Retire.js repository, an open-source, community-maintained list of JavaScript libraries with known vulnerabilities, refreshed daily.
A library is flagged but I cannot upgrade it. What now?
Check whether the CVE affects a feature you use, add a strict Content-Security-Policy to limit the impact, and plan the upgrade. Some findings are avoidable without upgrading, most are not.
Why was a library missed?
Bundled and renamed libraries lose the filename and URL patterns we match. We also read version strings inside the first part of each script, but heavily minified bundles can hide them.
