Paste any package name and version — see its CVEs, CVSS scores, version age, and latest release in seconds. 8 ecosystems · ecosystem auto-detected · powered by OSV.dev · no login · no tracking · no data stored.

bene-version-checker is an open-source package security tool that lets you audit any single dependency across eight language ecosystems. Enter a package name and version to instantly see:

• All known CVEs with CVSS v3.1 scores and affected version ranges
• How old the version you are running is
• The current latest stable release from the official registry
• A severity summary (CRITICAL / HIGH / MEDIUM / LOW)

No API keys. No accounts. All external calls to OSV and registry APIs happen server-side — your browser only ever contacts this site.

Ecosystem is auto-detected from the package name format — a confidence badge (auto-detected / likely) is shown in the UI. The dropdown can always be overridden manually.

• CVE lookup via OSV.dev — Google's Open Source Vulnerability database
• CVSS v3.1 base score — calculated directly from the vector string (spec-verified, no external library)
• Version normalization — strips ^, ~=, >=, v-prefix, NuGet bracket ranges before querying
• Ecosystem auto-detection — high/medium confidence classification from name format alone
• Latest version — fetched from each ecosystem's official registry in parallel with OSV
• Version age — how long ago the queried version was released
• Affected ranges — introduced/fixed version ranges from OSV data across all affected entries
• Per-IP rate limiting — 30 requests/minute (configurable via .env)
• No login · No tracking · No data stored

Security was a primary design concern for public deployment.

git clone https://github.com/Beneking102/bene-version-checker.git
cd bene-version-checker
npm install
npm run dev

Open http://localhost:3000.

Copy .env.example to .env.local and adjust as needed. No API keys are required — OSV.dev is a free public endpoint.

# Maximum requests per IP per window (default: 30)
RATE_LIMIT_MAX=30

# Window duration in milliseconds (default: 60 s)
RATE_LIMIT_WINDOW_MS=60000

Serverless note: The default rate limiter is in-memory and resets on cold starts (Vercel, Netlify). For persistent rate limiting in production, replace the store in lib/rateLimit.ts with Upstash Redis, which has a generous free tier and a Next.js SDK.

npx vercel

No environment variables required for basic use. Set RATE_LIMIT_MAX and RATE_LIMIT_WINDOW_MS if you want non-default limits.

npm run build
npm start        # runs on port 3000 by default

Place the app behind a reverse proxy that handles TLS termination. Caddy is the easiest option — it provisions and renews a free Let's Encrypt certificate automatically when you point a domain at it:

# /etc/caddy/Caddyfile
example.com {
    reverse_proxy localhost:3000
}

With nginx + Certbot:

sudo certbot --nginx -d example.com

Certificate note: HTTPS/TLS certificates are managed at the reverse-proxy layer, not inside Next.js. Platforms like Vercel and Netlify provision them automatically with no configuration needed.

All external calls (OSV, registries) happen server-side. The browser only posts to this endpoint.

Request body

{
  "name":      "lodash",
  "version":   "4.17.20",
  "ecosystem": "npm"
}

ecosystem must be one of: npm · PyPI · Maven · Go · crates.io · RubyGems · NuGet · Packagist

version accepts raw formats: 4.17.20, ^4.17.20, ~=4.17, >=4.0.0 <5, v4.17.20, [4.0.0, 5.0.0)

Success response — 200 OK

{
  "name":            "lodash",
  "version":         "4.17.20",
  "originalVersion": "^4.17.20",
  "ecosystem":       "npm",
  "latest":          "4.17.21",
  "releaseDate":     "2021-02-20T14:52:47.000Z",
  "vulns": [
    {
      "id":        "GHSA-35jh-r3h4-6jhm",
      "summary":   "Command Injection in lodash",
      "cvssScore": 7.2,
      "severity":  "HIGH",
      "published": "2021-02-15T00:00:00Z",
      "link":      "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
      "affectedRanges": [
        { "introduced": "0", "fixed": "4.17.21" }
      ]
    }
  ]
}

originalVersion is only present when the input was normalized (e.g. ^4.17.20 → 4.17.20).

Response headers

Error codes

Business Source License 1.1

Licensor:       Benedikt Pankratz
Licensed Work:  bene-version-checker
Change Date:    January 1, 2028
Change License: MIT

In plain English:

• ✓ Free to use for personal and non-commercial purposes, right now
• ✓ The source code converts to the MIT license on January 1, 2028
• ✗ Commercial use before that date requires a separate written agreement

For the full license text see BUSL-1.1.

© 2026 Benedikt Pankratz · @Beneking102