Nearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw

    About 28% of websites, more than 4.3 million homepages, load a version of a common JavaScript library with a publicly documented security flaw. Old copies of jQuery account for the most websites, on 3,428,748 homepages.

    Websites with a flawed version by library (vulnerable below)
    AngularJS (all versions)
    100%
    Handlebars (4.7.7)
    56%
    Moment.js (2.29.4)
    51.6%
    Bootstrap (3.4.1, or 4.0 to 4.3.0)
    44.7%
    jQuery (3.5.0)
    36.1%
    Lodash (4.17.21)
    33.6%
    jQuery UI (1.13.2)
    31.7%

    Source: Suff Digital analysis of 15,470,478 homepages · the public HTTP Archive crawl of 15.5 million websites, September 2026

    Source: Nearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw - Suff Digital