I have 5 moderate severity vulnerabilities when I checked the npm audit

Question

How can I fix these errors given below?

$ npm audit
# npm audit report

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
No fix available
node_modules/webpack-dev-server/node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of glob-parent
  node_modules/webpack-dev-server/node_modules/chokidar
    webpack-dev-server  2.0.0-beta - 3.11.2
    Depends on vulnerable versions of chokidar
    node_modules/webpack-dev-server
      @angular-devkit/build-angular  <=13.0.0-next.2
      Depends on vulnerable versions of @angular-devkit/build-webpack
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@angular-devkit/build-angular
      @angular-devkit/build-webpack  <=0.1300.0-next.2
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@angular-devkit/build-webpack

5 moderate severity vulnerabilities

Some issues need review, and may require choosing
a different dependency.

Answer 1

These are vulnerabilities discovered and reported for dependencies your application is using. Generally, you will want to fix these by updating packages to the latest versions containing fixes for the vulnerabilities.

There is a command, npm audit fix, which can update the affected dependencies for you in most cases (It took me personally from 10.000+ to roughly 10 reports). This however by default will only use non-breaking version jumps (so by semantic versioning it will not jump a major version for example).

You can use npm audit fix --force to fix the remaining vulnerabilities (including semver-incompatible ones) if there are package updates, however you will need to look for breaking changes in the updated packages that may conflict with your program logic.

I highly recommend you look at the NPM Docs article below, it explains the whole process very well.

Also see:

• Auditing package dependencies for security vulnerabilities
• What does "npm audit fix" exactly do?