debug (npm)

A tiny JavaScript debugging utility modelled after Node.js core's debugging technique. Works in Node.js and web browsers

Advisories

Latest version

4.4.3

Released Sep 13, 2025

License

MIT

OpenSSF Scorecard

2.6 / 10

How to fix

Upgrading to 4.4.3 or later clears every advisory below that has a fix.

Upgrade commands

npm

npm install debug@4.4.3

yarn

yarn add debug@4.4.3

pnpm

pnpm add debug@4.4.3

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover	High EPSS 0.48%	`>= 4.4.2, < 4.4.3`	`4.4.3`
GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover	High EPSS 0.48%		No fix yet
GHSA-4x49-vf9v-38px debug@4.4.2 contains malware after npm account takeover	High EPSS 0.48%		No fix yet
GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability	High EPSS 2.10%	`>= 3.0.0, < 3.1.0`	`3.1.0`
GHSA-9vvw-cc9w-f27h debug Inefficient Regular Expression Complexity vulnerability	High EPSS 2.10%	`< 2.6.9`	`2.6.9`
GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug	Low EPSS 2.83%	`>= 3.2.0, < 3.2.7`	`3.2.7`
GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug	Low EPSS 2.83%	`>= 4.0.0, < 4.3.1`	`4.3.1`
GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug	Low EPSS 2.83%	`< 2.6.9`	`2.6.9`
GHSA-gxpj-cx7g-858c Regular Expression Denial of Service in debug	Low EPSS 2.83%	`>= 3.0.0, < 3.1.0`	`3.1.0`

Source: git://github.com/debug-js/debug.git

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor