Check any website for JavaScript libraries with known CVEs
A CVE (Common Vulnerabilities and Exposures) is a publicly catalogued security flaw with a fixed ID, and once it is public, so is the exploit. Old front-end libraries such as jQuery, Bootstrap, and Angular are the most common way a live site keeps quietly shipping them to every visitor.
What a fail costs
On CheckWeb this is a weight-2 check on the Security axis, and Security is 35% of the overall score, the largest of the five axes. Only a missing HTTPS and a broken TLS certificate weigh more. A fail here means the site serves every visitor a library version with a published, exploitable flaw, exactly what an automated scanner spots in seconds.
Counted per version, not per package
Most scanners get this wrong, and the difference matters. They count every CVE the package ever had. jQuery has accumulated 8 CVEs across its lifetime, but a site running jQuery 1.8.2 is affected by only 5 of them; the rest were introduced later or fixed before it.
CheckWeb cross-references the detected version against the OSV and NVD advisory ranges and counts only the CVEs whose affected range includes that version, with the maximum severity computed over the same set. The result is a number worth acting on, not an alarmist lifetime total that falls apart the moment a developer checks it.
How it looks in the report
In a CheckWeb report, under the Security axis, this shows as a line reading "Vulnerable front-end libraries" with a red FAIL status. The evidence chip beneath names each library, version, per-version CVE count, and max severity: for example jQuery 1.8.2 with 5 known CVEs (max Medium) and Bootstrap 3.1.0 with 6 known CVEs (max Medium). A clean site shows PASS, "Recognized libraries have no known vulnerabilities." When no library version can be fingerprinted, the status is N/A, never a fake pass.
Vulnerable front-end libraries
jQuery 1.8.2: 5 known CVEs (max Medium); Bootstrap 3.1.0: 6 known CVEs (max Medium)
jquery@1.8.2, bootstrap@3.1.0
Exposed vs clean
Exposed
jQuery 1.8.2, affected by 5 known CVEs.
Clean
jQuery 3.7.x (current), matched by no CVE range.
The fix is almost always moving to the latest patch of the current major, not a rewrite.
How to fix it
- Plain script tags or CDN: bump the version in the CDN URL (or the vendored copy) to the latest patch release of that major.
- npm or a bundler: update the dependency and rebuild. `npm audit` surfaces the same OSV advisories CheckWeb uses.
- WordPress: the library is usually bundled by a plugin or theme rather than added directly, so update those and drop any that ship ancient copies. (See the WordPress security check.)
- Then verify: re-scan and watch the Security axis recover.
Check a site for vulnerable libraries
Paste a URL to see exactly which libraries and versions a site loads, each with its per-version CVE count and max severity. Fix, re-scan, and confirm the number drops to zero.
Check my website