Your files stay on your device

Vulnerable JavaScript library checker

Paste page HTML or a script list, read the library versions the URLs prove, and check those exact versions against the free OSV.dev advisory API, showing unknowns as not checked.
Pasted page sourceScript URLs

Nothing checked yet
Paste page HTML or a list of script URLs, then press Check against advisories.

Identification reads the fixed list of 26 library signatures below, and a version counts only when the URL itself states one: a full x.y.z file name, path segment, or npm tag. Query strings like ?ver= are ignored on purpose, because on many sites that value tracks the site build rather than the library. The advisory answers come from OSV.dev, a free and keyless service that aggregates GitHub Security Advisories and npm advisory data. The safety rule: an unreachable database, a version the URL never stated, and a file no signature matched all read as not checked, never as a clean pass. Script files a bundler wrote carry neither a library name nor a version, so they are invisible here; a source map or a build-time SBOM names them honestly.
OptionsCheck against advisories

More web & auth tools

- Subresource integrity (/web/sri)
- CSP evaluator & builder (/web/csp)
- HTTP timing probe (/network/http-timing)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/vulnerable-javascript-library-checker
Markdown version: https://nutter.tools/web/vulnerable-javascript-library-checker.md
Plain-text version: https://nutter.tools/web/vulnerable-javascript-library-checker.txt
Agent index: https://nutter.tools/llms.txt