npm package
vue 2.7.16 vulnerability, and the version that fixes it
vue 2.7.16 has 1 known vulnerability; 3.0.0-alpha.0 fixes it. Vue 2.7 reached end of life on Dec 31, 2023 and gets no more security fixes. Move to Vue 3.5. The maintainers deprecated this release.
npm (opens in a new tab) describes it as “The progressive JavaScript framework for building modern web UI.”
- Known vulnerabilities
- 1
- None rated high or critical
- Released
- Dec 24, 2023
- Latest is 3.5.44
- Downloads last week
- 837.7K
- 5% of vue downloads
- Vue 2.7 support
- End of life
- Since Dec 31, 2023
- Licence
- MIT
- Pulls in
- 12 packages
- Resolved by deps.dev
- Status
- Deprecated release
What to upgrade to
3.0.0-alpha.0 is the closest release with no known vulnerabilities.
3.0.0-alpha.0Upgrade to this
Fixes the known vulnerability. Released Dec 20, 2019.
No known vulnerabilitiesLatest release. Released Oct 13, 2026.
No known vulnerabilities
Hand the fix to your coding agent
One task with the upgrade, the file to change and why. Paste it into Claude Code, Cursor or Codex.
Findings
- CriticalEnd of life
Vue 2.7 is end-of-life
Support ended 2023-12-31. No more security fixes — upgrade to Vue 3.5 (3.5.44).
- WarningOutdated
vue 2.7.16 is 1 major version behind
Latest release is 3.5.44. The maintainers deprecated 2.7.16: "Vue 2 has reached EOL and is no longer actively maintained. See https://v2.vuejs.org/eol/ for more details."
- LowVulnerability
CVE-2024-9506 in vue 2.7.16
EPSS: top 57%ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function. Fixed in 3.0.0-alpha.0.
- LowOpenSSF Scorecard
vuejs/vue scores 3/10 on OpenSSF Scorecard
Weakest checks: Not actively maintained (Maintained 0/10); No branch protection (Branch-Protection 0/10); Over-privileged CI tokens (Token-Permissions 0/10). A low score means weaker upstream security practices, not a known vulnerability.
Every advisory for vue 2.7.16
Known exploited first (CISA KEV), then by how likely they are to be exploited (FIRST EPSS), then by severity. Each id links to its OSV.dev record.
LowCVE-2024-9506 on OSV.dev (opens in a new tab)GHSA-5j4c-8p2g-v4jxEPSS: top 57%
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Fixed in 3.0.0-alpha.0. Published Oct 15, 2024.
Who is still on a vulnerable vue
8% of last week’s 17.6M vue downloads went to versions with known vulnerabilities.
From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.
Is vue the only one?
Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task. Free, no sign-up.
How this page is checked
StackPrism asks OSV.dev which advisories affect exactly vue 2.7.16, merges duplicates filed under several ids, and ranks them with CISA’s Known Exploited Vulnerabilities list and FIRST EPSS. Release dates and deprecation come from deps.dev and npm, support dates from endoflife.date. No AI writes this page: every sentence comes from that data, refreshed every few hours.
Last checked against npm, OSV.dev, deps.dev, CISA KEV, FIRST EPSS and endoflife.date.