StackPrism

npm package

ejs vulnerabilities by version

The latest release, 7.0.1 (Oct 4, 2026), has no known vulnerabilities. 9% of last week’s 43.4M downloads went to versions with known vulnerabilities. OSV.dev lists 5 advisories for ejs; the newest was published on Apr 28, 2024.

npm (opens in a new tab) describes it as “Embedded JavaScript templates”

Latest release
7.0.1
Oct 4, 2026, no known vulnerabilities
Downloads last week
43.4M
All versions, from npm
Advisories on OSV.dev
5
Newest Apr 28, 2024
Licence
Apache-2.0
OpenSSF Scorecard
2.9/10
mde/ejs (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
3.1.10Apr 12, 2024No known vulnerabilities28.9M
5.0.1Mar 5, 2026No known vulnerabilities5.7M
6.0.1May 26, 2026No known vulnerabilities3.6M
2.7.4Nov 19, 20192 known vulnerabilities, worst rated critical1.7M
3.1.9Mar 12, 20231 known vulnerability, worst rated warning855.3K
5.0.2Apr 11, 2026No known vulnerabilities852.4K
3.1.8May 11, 20221 known vulnerability, worst rated warning705.8K
3.1.6Feb 6, 20212 known vulnerabilities, worst rated critical241.6K

Who is still on a vulnerable ejs

9% of last week’s 43.4M ejs downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. ejs doesn’t publish support dates we can check.

LineNewest releaseReleased
77.0.1Oct 4, 2026
66.0.1May 26, 2026
55.0.2Apr 11, 2026
44.0.1Jan 14, 2026
33.1.10Apr 12, 2024
22.7.4Nov 19, 2019

Newest advisories

The 5 most recently published, with the versions each one affects.

  1. WarningCVE-2024-33883 on OSV.dev (opens in a new tab)GHSA-ghr5-ch3p-vcr6

    ejs lacks certain pollution protection

    Affects < 3.1.10. Published Apr 28, 2024.

  2. CriticalCVE-2022-29078 on OSV.dev (opens in a new tab)GHSA-phwq-j96m-2c2q

    ejs template injection vulnerability

    Affects < 3.1.7. Published Apr 26, 2022.

  3. CriticalCVE-2017-1000189 on OSV.dev (opens in a new tab)GHSA-6x77-rpqf-j6mw

    ejs vulnerable to DoS due to weak input validation

    Affects < 2.5.5. Published Mar 5, 2018.

  4. CriticalCVE-2017-1000228 on OSV.dev (opens in a new tab)GHSA-3w5v-p54c-f74x

    ejs is vulnerable to remote code execution due to weak input validation

    Affects < 2.5.5. Published Nov 30, 2017.

  5. WarningCVE-2017-1000188 on OSV.dev (opens in a new tab)GHSA-hwcf-pp87-7x6p

    mde ejs vulnerable to XSS

    Affects < 2.5.5. Published Nov 30, 2017.

Which ejs do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for ejs, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.