---
title: "List Node.js vulnerabilities"
method: GET
path: "/api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities"
tags: ["Hosting: NodeJS"]
---

# List Node.js vulnerabilities

`GET /api/hosting/v1/accounts/{username}/websites/{domain}/nodejs/vulnerabilities`

Lists known npm package vulnerabilities detected on a Node.js website, enriched with
advisory metadata (severity, CVSS score, CVE, advisory URL). Results are sorted from
the most severe to the least severe, then by publish date (newest first). Use the
`severities` query parameter to filter.

Vulnerabilities with `is_patchable` set to `true` can be auto-fixed via the
`Patch Node.js Vulnerabilities` endpoint, which opens a GitHub pull request with
updated package versions. Auto-fix is only available for websites deployed from a
connected GitHub repository. Vulnerabilities with `is_patching_in_progress` set to
`true` are already included in an open patch pull request; while any patch pull
request is open, new patch requests for this website are rejected until it is merged
or closed.

Data comes from periodic dependency scans, so it may lag behind the latest deployment.
An empty list means the most recent scan found no vulnerabilities; it does not
guarantee the current deployment is vulnerability-free. Available on Business and
Cloud Hosting plans.

## Path parameters

- `username` string, required
- `domain` string, required

## Query parameters

- `severities` string[]

## Response `200`

Success response

- HostingV1NodeJsVulnerabilityResource[] — Array of [`Hosting.V1.NodeJs.VulnerabilityResource`](#model/hostingv1nodejsvulnerabilityresource)
  - `package_name` string — Name of the affected npm package
  - `installed_version` string — Version of the package currently installed
  - `is_direct` boolean — Whether the package is a direct dependency
  - `is_patchable` boolean — Whether the vulnerability can be auto-patched without a major version bump
  - `fix_version` string, nullable — Version that fixes the vulnerability, if known
  - `vulnerability_id` string — Unique vulnerability identifier (e.g. GHSA or CVE)
  - `severity` 'low' | 'moderate' | 'high' | 'critical' | 'unknown' — Severity level of the vulnerability
  - `title` string — Short human-readable title of the vulnerability
  - `description` string, nullable — Detailed description of the vulnerability
  - `cvss_score` number, float, nullable — CVSS base score (0.0-10.0)
  - `cve` string, nullable — CVE identifier, if available
  - `cwe` string, nullable — CWE identifier describing the weakness type
  - `url` string, nullable — URL to the vulnerability advisory
  - `published_at` string, date-time, nullable — Date the vulnerability was published, in ISO 8601 format
  - `is_patching_in_progress` boolean — Whether this vulnerability is included in a currently open patch pull request

## Other responses

- `401` — Unauthenticated response
- `500` — Error response

## Changes

- **2026-07-16** `ac0c9ed1537c` — 1 info
  - endpoint added
- **2026-06-09** `d05574986eb1` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/hostinger/apis/hostinger-api/changes/api/hosting/v1/accounts/:username/websites/:domain/nodejs/vulnerabilities/get.md)

---

[API](https://skmtc.dev/hostinger/apis/hostinger-api.md) · [All operations](https://skmtc.dev/hostinger/apis/hostinger-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hostinger/hostinger-api/revisions/53ccee45e5eb/schema)