---
title: "debug security advisories"
description: "4 known security advisories for debug, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/debug/security
lang: en
---

[Packages](https://inlinr.com/packages)

# debug

4.4.3 · 13 Sep 2025 MIT 930.4M / week [Repository](https://github.com/debug-js/debug) [Homepage](https://github.com/debug-js/debug#readme) [npm](https://www.npmjs.com/package/debug) [Atom feed](https://inlinr.com/packages/feed/debug)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                            |
| ---- | ------ | -------------------------------------------------------------------------- |
|      | 4.4.3  | Safe from 4.4.3                                                            |
|      | 3.2.7  | 20 open advisories, worst high  · last release Nov 2020, no longer updated |

- High  
[debug@4.4.2 contains malware after npm account takeover](https://inlinr.com/advisories/GHSA-4x49-vf9v-38px)GHSA-4x49-vf9v-38px · 15 Sep 2025  
fixed in 4.4.3
- High  
[debug Inefficient Regular Expression Complexity vulnerability](https://inlinr.com/advisories/GHSA-9vvw-cc9w-f27h)GHSA-9vvw-cc9w-f27h · 9 Jan 2023  
fixed in 3.1.0, 2.6.9
- Low  
[Regular Expression Denial of Service in debug](https://inlinr.com/advisories/GHSA-gxpj-cx7g-858c)GHSA-gxpj-cx7g-858c · 9 Aug 2018  
fixed in 4.3.1, 3.2.7, 2.6.9
- Malicious  
[Malicious code in debug (npm)](https://inlinr.com/advisories/MAL-2025-46974)MAL-2025-46974 · 8 Sep 2025  
safe in 4.4.3

### Quality and security signals

What [npm](https://www.npmjs.com/package/debug) and [deps.dev](https://deps.dev/npm/debug) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.