Nearly 3 in 10 Websites Load a JavaScript Library With a Known Security Flaw

A small business launches a website on a theme that looks good and works well. The theme brings along jQuery 1.12 and Bootstrap 3, two code libraries that power its menus, sliders and forms. Years later the site still sends visitors those exact files, and security researchers have long since published the flaws in both versions.

A JavaScript library is a package of ready-made code that websites load to handle common tasks, such as menus, date formatting or pop-up windows. When a flaw is found in a library, its developers release a fixed version and the flaw is published in a public database of vulnerabilities, so anyone can look it up. Common automated security scanners flag these versions, and they are a clear sign that nobody has updated the site's front end in a long time.

That describes a large share of the web. About 28% of homepages, more than 4.3 million, load at least one library version with a known flaw. Where the version of a tracked library can be read, the rate rises to more than 4 in 10. jQuery, the most common library, accounts for the largest number: 3,428,748 homepages run a version older than 3.5.0.

We used the public HTTP Archive crawl of September 2026, which records the JavaScript libraries and their versions on 15,470,478 website homepages. For eight widely used libraries, including jQuery, Bootstrap, jQuery UI, Lodash, Moment.js, AngularJS and Handlebars, we set the version below which a publicly documented flaw applies, such as jQuery below 3.5.0, and counted homepages that load at least one library below that line.

A homepage counts as vulnerable when it loads a library version older than the release that fixed a published flaw. When a website shows only the major version number of a library, such as Bootstrap 3, it counts as vulnerable when every release in that major version is older than the fix. AngularJS counts as vulnerable in every version because it stopped receiving updates at the end of 2021.

The 28% covers every homepage, including sites that load none of these libraries or hide the version number. Among websites where the version of a tracked library can be read, more than 4 in 10 run at least one flawed version. For the typical website that uses these libraries at all, an outdated copy is close to the normal state.

Most of these sites do not load the libraries by choice. The libraries arrive bundled with a theme, a page builder or a plugin, and they update only when that component updates. WordPress core, for example, ships its own current jQuery, but some themes load a separate, older copy alongside it. If the theme's developer stopped updating it, the old library stays on the site indefinitely.

jQuery is on more homepages than any other library in this study, so even a moderate rate produces very large numbers. 36.1% of websites that show their jQuery version run one older than 3.5.0. Cross-site scripting is a type of flaw that can let an attacker run their own code in a visitor's browser, for example to steal a login session or change what a form submits.

Most of that old jQuery is very old. 2,031,519 homepages still load jQuery 1.x, two major versions behind current jQuery. Updating jQuery can break older scripts, because jQuery 3 removed functions they depend on, and that is why many developers leave the old version in place. The longer that goes on, the more code depends on it and the bigger the eventual upgrade becomes.

By rate, the less common libraries are worse than jQuery. Every AngularJS website runs a framework that lost support at the end of 2021, and more than half of websites using Moment.js, a date library, or Handlebars, a templating library, run a version below the fixed release. Bootstrap, the popular design framework, has a flawed version on 44.7% of websites that show its version, 1,223,928 homepages.

Bootstrap shows the same pattern from another angle. In a separate Suff Digital study, 87.3% of websites that show their Bootstrap version run a major version that no longer receives any updates at all. Many sites load jQuery UI or Moment.js for a single small feature, such as a date picker, that modern browsers can now handle with a few lines of code.

Find out what your site loads. A free online scanner that lists JavaScript libraries will show the versions, or you can open your browser's developer tools and type jQuery.fn.jquery into the console to see the jQuery version. If you see jQuery below 3.5.0, Bootstrap 3, AngularJS or Moment.js, work out which theme or plugin loads it. Often an update to that component fixes the problem; if the component is no longer maintained, plan to replace it.

Then remove what you do not need. Every library a site loads is code someone has to keep current, and many sites carry jQuery UI or Moment.js for one small job. Test any library upgrade on a staging copy of the site first, since old scripts can break on new versions.

Front-end libraries do not update themselves, so checking them belongs in regular maintenance, not a one-off cleanup. Our website management plans include checks of the libraries a site loads and tested upgrades when a version falls behind.

Embed this research

Cite this study