Prototype Pollution Report

In a static build, server dependencies are limited to the build machine. A ReDoS in a Markdown parser might slow down a build, but visitors can’t trigger it. Request-time code runs on a live server, where anyone loading a page can reach it. Note that client dependencies ship to the browser either way, so their vulnerabilities can affect both Build-time and Request-time projects.

Shows npm audit is whether the framework’s official create tool shows npm audit results, including high severity vulnerabilities, after it installs dependencies. Hover a cell to see how it’s hidden.

• Across these 10 frameworks, dependencies and vulnerabilities correlate at r = 0.93.
• Vulnerabilities are affected packages in the install tree, as reported by npm audit. Next.js and Vite bundle many dependencies into their published code, and those are checked too wherever they appear in the install tree. Raw npm audit leaves them out.
• Note that Vite’s bundled dependencies run in its dev server and at build time, not when serving production requests.
• Advisories are distinct GitHub security advisories matched anywhere in the install tree. One advisory can flag every package that depends on the affected one, and one package can have several advisories, so this can be higher or lower than Vulnerabilities.
• Dependencies are unique name@version pairs across the whole ecosystem, installed together in one tree. Shared dependencies count once per version. Platform-specific builds of a native package (one per OS and CPU) count once. Third-party means not published by the framework’s npm organization.
• Past dates only count advisories published by that date.
• Snapshots are fresh installs, which pick up the newest patch releases each package allows.
• Each ecosystem also installs its core package’s required peer dependencies, like Vite for SvelteKit or React for Next.js, and its core package’s version of Vite (or the latest Vite, if the core doesn’t use it), so older versions from stale packages don’t displace it. Peer dependencies of other official packages aren’t installed.
• Forecasts count every package equally and are not currently weighted by download count.

Package Lists

• Across these 10 frameworks, dependencies and vulnerabilities correlate at r = 0.94.
• Includes required peer dependencies, like Vite and Svelte for SvelteKit.
• Note that Vite’s bundled dependencies run in its dev server and at build time, not when serving production requests.
• Forecasts count every package equally and are not currently weighted by download count.