Packages

canvas

3.2.3 · 31 Mar 2026MIT4.6M / weekRepositorynpmAtom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for canvas. It is read in your browser and sent nowhere.

LineNewestWhere it stands
3.2.3No known advisory
1.6.1328 open advisories, worst high · last release Oct 2018, no longer updated
  • High
    Buffer overflow in canvasGHSA-73rg-x683-m3qw · 7 May 2021
    • 1.x1.0.0 – 1.6.10Fixed in 1.6.11
    • 0.13.x and older0.0.1 – 0.13.1No fix, no longer updated · move to 1.6.11
  • Moderate
    Denial of Service in canvasGHSA-vpq5-4rc8-c222 · 5 Jun 2019
    • 1.x1.0.0 – 1.6.9Fixed in 1.6.10
    • 0.13.x and older0.0.1 – 0.13.1No fix, no longer updated · move to 1.6.10

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.