Vulnerability Scanning

How Hostinger scans your Node.js app's npm dependencies for known vulnerabilities and fixes them via auto-generated GitHub pull requests, GitLab merge requests, or manual patching.

Hostinger scans the npm packages your Node.js app installs against known-vulnerability advisories and flags anything that needs patching. Find it under Security → Vulnerabilities in your website dashboard.

When scans run

• After every deployment — each successful build records your dependency tree and scans it.

• Periodically — deployed apps are re-scanned on a regular schedule, so new advisories surface even without a deploy.

An app that hasn't been deployed since the feature was enabled shows "Not scanned yet — your next deployment will trigger a scan."

What you see

The Unpatched dependencies table lists each affected package with:

• Package name and installed version

• Whether it's a direct dependency (in your package.json) or transitive (pulled in by another package)

• The version that fixes the issue

• Advisory ID (CVE), CVSS score, severity, and publish date

Severity levels: critical, high, moderate, low (and unknown when no score is available). Filter by severity or search by package name or CVE. Expand a row for details.

Email notifications

When new vulnerabilities are found in your app, Hostinger emails you. Unchanged findings aren't re-notified more than once a week.

Fixing vulnerabilities

Git-deployed apps: Auto-fix pull requests

If your app deploys from a connected GitHub or GitLab repository, select the vulnerabilities to fix and click Auto-fix:

1. Hostinger creates a pull request on your GitHub repository, or a merge request on your GitLab project, that bumps the affected packages to patched versions.

2. You review and merge it yourself — nothing goes live until you merge.

3. Merging triggers the usual auto-deployment, and the next scan confirms the fix.

The PR includes a table of each package, its old and new version, and the advisory it addresses. After merging, run an install locally to refresh your lockfile if you work on the project elsewhere.

Auto-fix requires an active GitHub or GitLab connection — if the button is disabled with "GitHub is not connected" or "GitLab is not connected", reconnect first.

Archive-deployed apps: manual patching

Update the flagged packages in your project (npm update <package> or bump the version in package.json), rebuild your archive, and redeploy via Deployments → Deployment settings.

Related

• GitHub and GitLab — connecting a repository

• Deployments — redeploying after a fix

---

Last updated: October 21, 2026