Vulnerability Scanning
How Hostinger scans your Node.js app's npm dependencies for known vulnerabilities and fixes them via auto-generated GitHub pull requests or manual patching.
Last updated
Was this helpful?
How Hostinger scans your Node.js app's npm dependencies for known vulnerabilities and fixes them via auto-generated GitHub pull requests or manual patching.
Hostinger scans the npm packages your Node.js app installs against known-vulnerability advisories and flags anything that needs patching. Find it under Security → Vulnerabilities in your website dashboard.
After every deployment — each successful build records your dependency tree and scans it.
Periodically — deployed apps are re-scanned on a regular schedule, so new advisories surface even without a deploy.
An app that hasn't been deployed since the feature was enabled shows "Not scanned yet — your next deployment will trigger a scan."
The Unpatched dependencies table lists each affected package with:
Package name and installed version
Whether it's a direct dependency (in your package.json) or transitive (pulled in by another package)
The version that fixes the issue
Advisory ID (CVE), CVSS score, severity, and publish date
Severity levels: critical, high, moderate, low (and unknown when no score is available). Filter by severity or search by package name or CVE. Expand a row for details.
When new vulnerabilities are found in your app, Hostinger emails you. Unchanged findings aren't re-notified more than once a week.
If your app deploys from a connected GitHub repository, select the vulnerabilities to fix and click Auto-fix:
Hostinger creates a pull request on your GitHub repository that bumps the affected packages to patched versions.
You review and merge it yourself — nothing goes live until you merge.
Merging triggers the usual auto-deployment, and the next scan confirms the fix.
The PR includes a table of each package, its old and new version, and the advisory it addresses. After merging, run an install locally to refresh your lockfile if you work on the project elsewhere.
Auto-fix requires an active GitHub connection — if the button is disabled with "GitHub is not connected", reconnect first.
Update the flagged packages in your project (npm update <package> or bump the version in package.json), rebuild your archive, and redeploy via Deployments → Deployment settings.
GitHub — connecting a repository
Deployments — redeploying after a fix
Last updated: July 22, 2026
Last updated
Was this helpful?
Was this helpful?