diff

9.0.0 · 13 Apr 2026BSD-3-Clause85M / weekRepository npm Atom feed

Security advisories

From OSV. Open ones first, then the most severe. "Fixed in" is read against the latest release, 9.0.0.

Severity	Advisory	Affected	Fixed in
High	Regular Expression Denial of Service (ReDoS)GHSA-h6ch-v84p-w6p9 · 13 Jun 2019	< 3.5.0	3.5.0
Low	jsdiff has a Denial of Service vulnerability in parsePatch and applyPatchGHSA-73rr-hh4g-fpgx · 14 Jan 2026	>= 6.0.0, < 8.0.3 · >= 5.0.0, < 5.2.2 · >= 4.0.0, < 4.0.4 · < 3.5.1	8.0.3

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 20 October 2026. Releases and advisories last read 20 October 2026.