---
description: Information about security vulnerability reports in Mocha's dependencies
title: Security Vulnerability Reports
---

{/* Use `ldquo` (left double quote) HTML because Astro wrongly makes it right quote otherwise */}
{/* Use `rdquo` for consistency (in case we change settings later and don't notice this) */}

## &ldquo;`npm audit` or GitHub Advisories reported a vulnerability in a package Mocha depends on!&rdquo;

We probably know already 🙂

First and foremost, please check [Mocha issue 5781: Security Dashboard](https://github.com/mochajs/mocha/issues/5781), which tracks all reported potential security issues.

Second, please read the vulnerability to see if it actually applies to Mocha in your configuration (or any reasonable configuration you can imagine/test). As a test framework, Mocha is very unlikely to be affected by security vulnerabilities, as it only runs code that you as a developer provide to it.

Finally, consider reading [Josh Goldberg's March 2025 blog on npm security reports](https://www.joshuakgoldberg.com/blog/please-stop-sending-me-nested-dependency-security-reports/). He's a Mocha maintainer and the core of the post remains true today.

We appreciate your concern, but we don't want to overreact or stress ourselves out unless there is a real reason to believe Mocha itself is actually affected.

## Why is Mocha less likely to be affected?

As a test framework, Mocha:

- Runs in a development environment, not production
- Only executes code that you, as a developer, write and provide
- Doesn't process untrusted user input in typical usage
- Is not exposed to external networks in normal test scenarios

Most security vulnerabilities in dependencies are relevant for production applications that handle user input, make network requests, or process untrusted data. These scenarios rarely apply to Mocha's use case as a testing tool.

## What if there's a real security issue?

If you believe you've found a genuine security vulnerability that affects Mocha itself (not just a transitive dependency), please report it responsibly through our [security policy](https://github.com/mochajs/mocha/blob/main/SECURITY.md).

## My build is failing, how do I workaround this?

We encourage you to find or add manual workarounds for any system that blocks PRs on `npm audit` or similar warnings. Any system that automatically blocks a process should have a manual override for known false positives.

If you can't make workaround your system, you're welcome to clone Mocha, update dependencies, rebuild from source, and use that instead of the publicly-available version. And if you have a fix for us, we're happy to review PRs!
