Check your stack

A stack check matches the package names, ecosystems, and pinned versions in your lockfile against the affected version ranges in cve.now's catalog. You get a report of the vulnerabilities to review and a stack feed that contains only the vulnerabilities affecting your packages.

Prerequisites

• A supported lockfile, or a list of packages with exact versions.

Supported lockfiles

package-lock.json, npm-shrinkwrap.json, bun.lock, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt, Cargo.lock, go.sum, Gemfile.lock, mix.lock, and flake.lock.

cve.now detects the file type from its content. Manifests such as package.json are not lockfiles and are rejected with a message saying so: upload the lockfile your package manager writes.

A flake.lock pins source trees, not packages. cve.now looks up the git commit each input pins in OSV, which only knows the projects it tracks by commit. Package CVEs in nixpkgs are not checked, and the commit hashes are sent to OSV.

Upload a lockfile on cve.now

1. Open the cve.now homepage.
2. Drop your lockfile on the upload area, or choose it from your computer.
3. cve.now opens your stack report at a cve.now/stack/ URL.

The report shows how many packages were checked, how many are critical or known exploited, and each vulnerability to review with the matched package version. It checks the current catalog each time you open it, so revisiting the report shows newly published vulnerabilities.

The report also gives you a stack feed URL, https://cve.now/stack?s= followed by your stack's id. Subscribe to it in a feed reader or Slack to hear about new vulnerabilities in your packages. See Subscribe to feeds.

Upload a lockfile from the command line

Post the file to /api/stack with its name in the X-Lockfile-Name header:

curl --data-binary @bun.lock -H 'X-Lockfile-Name: bun.lock' https://cve.now/api/stack

The response has the stack's id and an href to its stack feed. Pass the id to a coding agent's check_stack tool as stack_id to check a large lockfile without sending its contents through the agent. See Connect a coding agent.

Pass a package list in a URL

For a short list of packages, build the stack feed URL yourself:

https://cve.now/stack?p=npm:lodash@4.17.20,pypi:django@4.2.0

• p is a comma-separated list of ecosystem:name@version items, such as npm:@scope/name@1.0.0 or maven:org.apache.logging.log4j:log4j-core@2.14.1.
• The ecosystems are npm, pypi (or pip), go (or golang), crates.io (crates or cargo), rubygems (or gem), packagist (or composer), nuget, and maven.
• format is rss (the default) or json. The JSON response has the number of packages checked and the matching entries.
• A URL takes at most 500 packages. A missing or malformed p, an unknown ecosystem, an unsupported format, or more than 500 packages returns HTTP 400. For more packages, upload a lockfile instead.

What happens to your lockfile

An uploaded lockfile is stored privately, parsed, and deleted as soon as it has been read. cve.now keeps only the list of package names and versions, to build your report and stack feed. Anyone with your report or stack feed link can see the vulnerability matches and the matched package versions, so share it as you would share a dependency list.

What a check covers

A check covers known advisories that list affected versions in a supported package ecosystem, across the full catalog. A result with no matches does not prove your packages are safe: it does not cover vulnerabilities without version data, unsupported ecosystems, or anything not yet disclosed. See Data and coverage.

Verify

Open your stack report, or request your stack feed with format=json, and confirm it shows the number of packages checked. For a quick test, https://cve.now/stack?p=npm:lodash@4.17.20&format=json should report one package checked and list lodash vulnerabilities fixed in later versions.