Packages

pg

8.23.1 · 30 Sep 2026MIT40.1M / weekRepositorynpmAtom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Is your project affected?

Paste your package.json, or type the range you declare for pg. It is read in your browser and sent nowhere.

LineNewestWhere it stands
8.23.1No known advisory
7.18.217 open advisories, worst critical · last release Feb 2020, no longer updated
  • Critical
    Remote Code Execution in pgGHSA-wc9v-mj63-m9g5 · 24 Jul 2018
    • 7.x7.0.0 – 7.1.1Fixed in 7.1.2
    • 6.x6.0.0 – 6.4.1Fixed in 6.4.2
    • 5.x5.0.0 – 5.2.0Fixed in 5.2.1
    • 4.x4.0.0 – 4.5.6Fixed in 4.5.7
    • 3.x3.0.0 – 3.6.3Fixed in 3.6.4
    • 2.x2.0.0 – 2.11.1Fixed in 2.11.2
    • 1.x and older0.0.1 – 1.3.0No fix, no longer updated · move to 2.11.2

Quality and security signals

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.