Backend framework
Django: supported versions and open vulnerabilities today
Django 6.1, 6.0 and 5.2 are supported; 5.1 reached end of life on Dec 3, 2025; the latest release is 6.1.2. 8 high or critical advisories for Django were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, PyPI, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 6.1.2
- GitHub stars
- 91.4k
- Licence
- BSD-3-Clause
- OpenSSF Scorecard
- 6.7 / 10
Supported versions
Security advisories
30 advisories published in the last 12 months, 8 of them high or critical. 162 in total since records began. Checked packages: django.
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
Fixed in 5.2.17 and 6.0.8.
EPSS: top 35%Django: SGI requests with a missing or understated `Content-Length` header could bypass the `DATA_UPLOAD_MAX_MEMORY_SIZE` limit
Fixed in 4.2.30, 5.2.13 and 6.0.4.
EPSS: top 43%Django vulnerable to ASGI header spoofing via underscore/hyphen conflation
Fixed in 4.2.30, 5.2.13 and 6.0.4.
EPSS: top 56%Django vulnerable to Uncontrolled Resource Consumption
Fixed in 4.2.29, 5.2.12 and 6.0.3.
EPSS: top 34%Django has an SQL Injection issue
Fixed in 4.2.28, 5.2.11 and 6.0.2.
EPSS: top 43%Django has an SQL Injection issue
Fixed in 4.2.28, 5.2.11 and 6.0.2.
EPSS: top 4%Django vulnerable to SQL injection via _connector keyword argument in QuerySet and Q objects.
Fixed in 4.2.26, 5.1.14 and 5.2.8.
EPSS: top 3%Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
Fixed in 4.2.26, 5.1.14 and 5.2.8.
EPSS: top 21%
Maintenance and supply chain
OpenSSF Scorecard 6.7 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 0 issue updates found in the last 90 days.
Weakest checks
- Over-privileged CI tokens (Token-Permissions 0/10)
- Unpinned build dependencies (Pinned-Dependencies 0/10)
- No static analysis (SAST 0/10)
Production checklist
Django production checklist: 6 checks before launch
- Must do: Run the deployment checklist: DEBUG off, SECRET_KEY from the environment
- Should do: Set ALLOWED_HOSTS to your own domains
- Should do: Force HTTPS: SSL redirect, HSTS and secure cookies
Alternatives
Express.js
Minimal Node.js web framework
Strengths
- Lightweight and flexible
- Huge ecosystem
Trade-offs
- Minimal built-in features
- Manual setup required
FastAPI
Modern Python framework for building APIs with type hints
Strengths
- Extremely fast performance (on par with Node/Go)
- Automatic API documentation (OpenAPI/Swagger)
Trade-offs
- Younger ecosystem than Django/Flask
- Less built-in features than Django
Ruby on Rails
Full-stack web framework emphasizing convention over configuration
Strengths
- Convention over configuration (rapid development)
- Rich ecosystem of gems (libraries)
Trade-offs
- Slower runtime performance than competitors
- Monolithic architecture can be restrictive
Spring Boot
Java framework for building production-ready applications
Strengths
- Enterprise-grade with robust ecosystem
- Comprehensive security and transaction management
Trade-offs
- Verbose compared to modern frameworks
- Steep learning curve for beginners
Docs and release notes
Check Django in your own stack
This page checks Django in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.