[BUG] `npm audit` prints `fix available via npm audit fix`, but it doesn't fix anything

[hirehamir]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

npm audit prints fix available via npm audit fix, but running npm audit fix doesn't fix anything.

The CLI advertises a fix that doesn't work.

Expected Behavior

If the npm CLI says a fix is available via npm audit fix, running

npm audit fix

should automatically fix the issue, like it does in a lot of other cases.

Steps To Reproduce

1. npm init -y
2. npm i -D tsx@4.21.0
3. npm audit "1 low severity vulnerability … fix available via npm audit fix"
4. npm audit fix "up to date", vulnerability still listed

Environment

• npm: 11.17.0
• Node.js: v24.13.0
• OS Name: Ubuntu 24.04.4 LTS
• npm config:

; node bin location = /home/hamir/.nvm/versions/node/v24.13.0/bin/node
; node version = v24.13.0
; npm local prefix = /home/hamir/private
; npm version = 11.17.0
; cwd = /home/hamir/private
; HOME = /home/hamir
; Run `npm config ls -l` to show all defaults.

[AKUMA-creator-ng]

This is a known issue with npm audit fix. The 'fix available' message appears when a patched version exists, but npm audit fix sometimes cannot apply it due to:

1. Peer dependency conflicts - The fix requires a version that conflicts with other dependencies
2. Version range constraints - The fix version is outside the allowed range in package.json
3. Transitive dependencies - The vulnerable package is deep in the dependency tree

Workarounds:

# Force fix (may break things)
npm audit fix --force

# Manual fix - install the specific version
npm install vulnerable-package@fixed-version

# Or use a different scanner that gives more context:
pip install vulnledger
vulnledger scan . --json

VulnLedger gives you the exact fix version for each CVE, which you can then apply manually.

For a more reliable fix process:

1. Run vulnledger scan . --json to get structured CVE data
2. For each critical/high CVE, check if the fix version is compatible
3. Update package.json with the specific fix version
4. Run npm install and test

This manual approach is more reliable than npm audit fix for complex dependency trees.