acorn (npm)
A small, fast, JavaScript-based JavaScript parser
Advisories
6
Latest version
8.19.0
Released Oct 5, 2026
License
MIT
OpenSSF Scorecard
4.9 / 10
How to fix
Upgrading to 7.1.1 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install acorn@8.19.0yarn
yarn add acorn@8.19.0pnpm
pnpm add acorn@8.19.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-6chw-6frg-f759 Regular Expression Denial of Service in Acorn |
High | >= 5.5.0, < 5.7.4 | 5.7.4 |
| GHSA-6chw-6frg-f759 Regular Expression Denial of Service in Acorn |
High | >= 6.0.0, < 6.4.1 | 6.4.1 |
| GHSA-6chw-6frg-f759 Regular Expression Denial of Service in Acorn |
High | >= 7.0.0, < 7.1.1 | 7.1.1 |
| GHSA-7fhm-mqm4-2wp7 Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution) Withdrawn |
Medium | < 5.7.4 | 5.7.4 |
| GHSA-7fhm-mqm4-2wp7 Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution) Withdrawn |
Medium | >= 6.0.0, < 6.4.1 | 6.4.1 |
| GHSA-7fhm-mqm4-2wp7 Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution) Withdrawn |
Medium | >= 7.0.0, < 7.1.1 | 7.1.1 |
Source: git+https://github.com/acornjs/acorn.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor