StackPrism

npm package

vue vulnerabilities by version

The latest release, 3.5.44 (Oct 13, 2026), has no known vulnerabilities. 8% of last week’s 17.6M downloads went to versions with known vulnerabilities. OSV.dev lists 1 advisory for vue; the newest was published on Oct 15, 2024.

npm (opens in a new tab) describes it as “The progressive JavaScript framework for building modern web UI.”

Latest release
3.5.44
Oct 13, 2026, no known vulnerabilities
Downloads last week
17.6M
All versions, from npm
Advisories on OSV.dev
1
Newest Oct 15, 2024
Licence
MIT
OpenSSF Scorecard
6.3/10
vuejs/core (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
3.5.43Sep 17, 2026No known vulnerabilities4.9M
3.5.42Aug 27, 2026No known vulnerabilities1.6M
3.5.41Aug 5, 2026No known vulnerabilities1.3M
2.7.16Dec 24, 2023End of life1 known vulnerability, worst rated lowDeprecated837.7K
3.5.40Jul 16, 2026No known vulnerabilities801.2K
3.3.4May 18, 2023End of lifeNo known vulnerabilities751.1K
3.5.39Jun 25, 2026No known vulnerabilities729.3K
3.5.13Nov 15, 2024No known vulnerabilities557.4K

Who is still on a vulnerable vue

8% of last week’s 17.6M vue downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

Support dates from endoflife.date (opens in a new tab). A line past its end date gets no more security fixes.

LineLatestSecurity support
3.53.5.44No end date announced
3.43.4.38Ended Sep 3, 2024
3.33.3.13Ended Dec 29, 2023
2.72.7.16Ended Dec 31, 2023
3.23.2.47Ended May 11, 2023
3.13.1.5Ended Aug 9, 2021

Newest advisories

The 1 most recently published, with the versions each one affects.

  1. LowCVE-2024-9506 on OSV.dev (opens in a new tab)GHSA-5j4c-8p2g-v4jx

    ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

    Affects >= 2.0.0-alpha.1, < 3.0.0-alpha.0. Published Oct 15, 2024.

Which vue do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for vue, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm, deps.dev and endoflife.date.