npm audit down?

[lumadev]

Select Topic Area

Question

Body

Hi everyone,

I'm consistently getting a "500 Internal Server Error" when running pnpm audit and yarn audit in my projects.

I’ve checked the official npm status page and searched online, but I can't find any reports of an ongoing outage. Is anyone else experiencing this?

[jpSimkins]

It seems so. I am having 500 errors on all my GitHub actions and local environments. I noticed this for about 4 hours now. Was coming here to post this but saw your ticket

[bari199]

According to npm docs, audit commands send your dependency tree to the registry to retrieve vulnerability reports, so failures often happen when the registry endpoint is unstable or returning errors.
You can try a few quick checks to rule out local causes:
Verify your registry:
npm config get registry (should typically be https://registry.npmjs.org/)
Clear cache:
npm cache clean --force
Retry with ignore flag (pnpm):
pnpm audit --ignore-registry-errors
Check if you’re behind a proxy/VPN or corporate network
Try again after some time — transient 500 errors are often temporary
If others aren’t reporting it widely, it could also be related to network routing, DNS, or a custom/private registry configuration.

[jpSimkins]

I appreciate the details.

Considering that the entire development team (spread across many states, remote dev teams) and our GitHub Actions workflows are all affected, Occam’s razor would suggest this is likely an upstream issue rather than an isolated one.

With that said, it's worth a shot:

Initial audit:

$ pnpm audit
 WARN  post https://registry.npmjs.org/-/npm/v1/security/audits error (500). Will retry in 10 seconds. 2 retries left.
 WARN  post https://registry.npmjs.org/-/npm/v1/security/audits error (500). Will retry in 1 minute. 1 retries left.
 ERR_PNPM_AUDIT_BAD_RESPONSE  The audit endpoint (at https://registry.npmjs.org/-/npm/v1/security/audits) responded with 500: {"error":"Internal Server Error"}

Validation and Cache Clearing:

$ npm config get registry
https://registry.npmjs.org/

$ npm cache clean --force
npm warn using --force Recommended protections disabled.

Audit while ignoring registry errors:

$ pnpm audit --ignore-registry-errors
 WARN  post https://registry.npmjs.org/-/npm/v1/security/audits error (500). Will retry in 10 seconds. 2 retries left.
 WARN  post https://registry.npmjs.org/-/npm/v1/security/audits error (500). Will retry in 1 minute. 1 retries left.
The audit endpoint (at https://registry.npmjs.org/-/npm/v1/security/audits) responded with 500: {"error":"Internal Server Error"}

 No proxy issues or anything. I did attempt to use a VPN to CA since I am in FL. Same issue. At this point, it seems to be an upstream issue. Not sure how many people will complain about it.
 

[eugenefm]

Down for me too

[jpSimkins]

Actually, it is NOT fully down. While I can get it to work with a minimal package.json:

{
  "name": "tmp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "devDependencies": {
    "typescript": "5.9.3"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "packageManager": "pnpm@10.30.0"
}

As soon as I add any packages like eslint, jest, or typedoc it errors out.

[trystian1]

Down for us as well, any news on this ?

[jpSimkins]

I think the issue may be due to minimatch and we will need to wait for a patch. (not absolute and could be completely wrong)

A simple test:

{
  "name": "tmp",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "devDependencies": {
    "minimatch": "^9.0.5"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "packageManager": "pnpm@10.30.0"
}

and we have the audit failure.

If you view it:

$ npm view minimatch

minimatch@10.2.2 | BlueOak-1.0.0 | deps: 1 | versions: 119
a glob matcher in javascript
https://github.com/isaacs/minimatch#readme

dist
.tarball: https://registry.npmjs.org/minimatch/-/minimatch-10.2.2.tgz
.shasum: 361603ee323cfb83496fea2ae17cc44ea4e1f99f
.integrity: sha512-+G4CpNBxa5MprY+04MbgOw1v7So6n5JY166pFi9KfYwT78fxScCeSNQSNzp6dpPSW2rONOps6Ocam1wFhCgoVw==
.unpackedSize: 460.2 kB

dependencies:
brace-expansion: ^5.0.2 

maintainers:
- isaacs <removed>

dist-tags:
latest: 10.2.2     legacy-v7: 7.4.6   legacy-v4: 4.2.3   legacy-v5: 5.1.6   v3.0-legacy: 3.0.8 v3-legacy: 3.1.2   

published 5 hours ago by isaacs <removed>

the only dependency is brace-expansion which works fine with the audit.

So this leads me to believe it is an issue with minimatch.

They even state:

This is the matching library used internally by npm.

Other packages I use seem to use this package as a dependency directly or as a dependency of a dependency.

If I remove all packages that use this, audit works for me.

While not the best way to identify the issue, and perhaps even completely wrong, this is my assessment for my repos.

They do seem to have a vulnerability (ReDoS risk) that I have seen 2 PRs for.

While I am not 100% sure if that is the cause for everyone's issue with audit not working, this does appear to be the issue for me.

Since nx and eslint both use this, when you try to audit with either of these, then you get the 500 error.

[lumadev]

Thanks for the detailed feedback @jpSimkins. It really was related to some specific dependencies. I ran some tests yesterday and it seemed to be linked to my devDependencies, though I couldn't identify exactly which ones.

We tested it today and it’s back up and running!

[Vaibhav-S-Gowda]

If npm audit or pnpm audit returns:

500 Internal Server Error

The registry is not down.
The audit API is likely crashing while processing specific versions of minimatch (e.g., 9.0.5, 10.2.2).

---

Evidence

Minimal reproduction:

{
  "name": "audit-test",
  "devDependencies": {
    "minimatch": "^9.0.5"
  }
}

Running:

pnpm audit

Returns 500.

Removing minimatch → audit succeeds.

---

Why This Happens

• Recent minimatch release
• ReDoS vulnerability discussions
• Audit server likely hitting timeout or unhandled exception while scanning its dependency graph
• minimatch is widely used (ESLint, Nx, npm), so many projects are indirectly affected

---

How to Confirm

grep minimatch pnpm-lock.yaml
# or
grep minimatch yarn.lock

If you see 9.x or 10.x, this is likely the trigger.

---

Workaround

Recommended: Wait for Patch

Since this affects a core ecosystem dependency, a fix is likely being prioritized.

Optional: Pin Stable Version

pnpm

{
  "pnpm": {
    "overrides": {
      "minimatch": "7.4.6"
    }
  }
}

Yarn

{
  "resolutions": {
    "minimatch": "7.4.6"
  }
}

Reinstall dependencies after pinning.

---

Bottom Line

This is not a local issue or full registry outage.
The npm audit API is likely failing while processing certain minimatch versions.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[Vaibhav-S-Gowda]

Hey, you're definitely not alone on this one , it's a known, widespread issue and here's what's actually going on:

---

What's happening:

npm appears to be retiring the legacy "Quick Audit" endpoint (/-/npm/v1/security/audits/quick)
without prior public notice or coordination with major third-party tools like pnpm and Yarn.

The issue isn't a full registry outage — the same endpoint returns a 200 for some minimal
payloads but crashes with a 500 for others. This points to something wrong in the audit
service's processing logic rather than a complete system failure. Notably, npm's status page
was showing "All Systems Operational" the whole time, which is why you couldn't find any
outage reports.

Both pnpm audit and yarn audit are confirmed affected, and it's been breaking CI pipelines
across GitHub Actions and local environments for multiple teams.

---

Why pnpm and yarn are hit harder than npm:

pnpm uses the legacy /-/npm/v1/security/audits endpoint, while npm audit (v7+) uses a
different, newer bulk advisory endpoint (/-/npm/v1/security/advisories/bulk) — which is
still working fine.

---

Workarounds you can try right now:

1. For pnpm — Use npm's working bulk endpoint instead:
   npm install --ignore-scripts --package-lock-only && npm audit

2. Check your registry config:
   npm config get registry
   npm cache clean --force

3. Skip the registry errors temporarily (pnpm):
   pnpm audit --ignore-registry-errors

4. Check if a specific dependency is causing the crash — it's been linked to packages like
   minimatch (versions 9.0.5, 10.2.2) and projects using nx or eslint. Try isolating your
   devDependencies to find the culprit.

[jpSimkins]

This is not the same issue. The issue you are talking about is more recent which makes this issue moot.

[Vaibhav-S-Gowda]

This is not the same issue. The issue you are talking about is more recent which makes this issue moot.

Sorry!! My bad.

[Acharya-Sonam]

Hi, you’re not alone — this issue is likely not on your side.

A 500 Internal Server Error when running npm audit, pnpm audit, or yarn audit usually indicates a server-side problem with the npm registry, not your project configuration. These audit commands send dependency data to the registry to fetch vulnerability reports, so if the endpoint fails, you’ll see this error .

There have been similar cases where audit endpoints return errors (500/502/410), often due to:

Registry-side issues or outages
Changes or deprecation of audit endpoints
Proxy/private registry misconfiguration
What you can try:
Run:
npm config get registry
Ensure it’s:
https://registry.npmjs.org/
npm cache clean --force
Try again later (very common fix for 500 errors)
If using corporate network / proxy, check registry access

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[maatthc]

This is still happening with pnpm.. none of the above workarounds worked for me. Any other clues?

[HariomAcharya17]

Yes, others are experiencing this. npm is retiring the old audit endpoint that pnpm and yarn use, but didn't announce it. That's why npm audit works fine but pnpm/yarn get 500 errors.

do this
npm install
npm audit

[xantius]

I'm seeing an outage personally, or maybe this is a different thing. https://registry.npmjs.org/-/npm/v1/security/advisories/bulk is failing 95% of the time as of about 2-3 hours ago. Status page says that things are "fine".

[az-nextsec]

Same here! Not using pnpm, just normal npm

[tanmaysamanta40904]

Sometime it's failing sometime it's taking way more time than expected.

npm audit --summary
npm notice This endpoint is being retired. Use the bulk advisory endpoint instead. See the following docs for more info: https://api-docs.npmjs.com/#tag/Audit
npm warn audit 400 Bad Request - POST https://registry.npmjs.org/-/npm/v1/security/audits/quick - Bad Request
{
statusCode: 400,
error: 'Bad Request',
message: 'Invalid package tree, run npm install to rebuild your package-lock.json'
}
npm error audit endpoint returned an error

Here is the time diff
npm install --no-audit 0.56s user 0.10s system 123% cpu 0.537 total
npm install 1.96s user 0.62s system 0% cpu 7:01.10 total

[Tristan-van-de-Beld]

Still reproducible on 4 September 2026 using pnpm 11.1.3 in GitHub-hosted Actions.

Endpoint:
https://registry.npmjs.org/-/npm/v1/security/advisories/bulk

The request timed out after pnpm’s built-in retries:

[WARN] POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk error (23). Will retry in 10 seconds. 2 retries left.
[WARN] POST https://registry.npmjs.org/-/npm/v1/security/advisories/bulk error (23). Will retry in 1 minute. 1 retries left.
[23] The operation was aborted due to timeout

We observed this across four hosted validation attempts. One later CI attempt succeeded, but release validation failed again shortly afterwards, which suggests an intermittent service problem rather than a complete outage.

Dependency installation, migrations, linting, type-checking, unit tests, Playwright tests, container build, smoke testing, and the Trivy scan passed. Only pnpm audit --audit-level high failed.

At the time of these failures, npm’s status page reported Security Audit as operational.

[lppedd]

@chrisrackstallion doesn't seem so unfortunately. /advisories/* is still not responding.

[chrisrackstallion]

I'm running through importmap audit. Same URL. Albeit a small payload. If you’re still timing out, it’s likely regional or a larger body I suppose.

[lppedd]

Now it looks like I can also reach the endpoints in a stable manner. But it might also be because people stopped trying and that has freed up some bandwidth.

[alexc155]

Still down for me - perhaps they're fixing it for one user at a time...

[lppedd]

Perhaps I got lucky with some load balancer that has let my requests through ahaha.
But it's still slow, and that means stuff's not working as expected yet.

Status page is all green btw, honestly I'd appreciate more transparency. But again, most "status" pages are like this.

[narwajea]

Also happening with bun audit. It hangs forever.

Check with:

curl -m 15 -X POST 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk' \
  -H 'content-type: application/json' \
  -d '{"lodash":["4.18.1"]}'

[narwajea]

See npm/cli#9950 and https://github.com/orgs/community/discussions/192768

[d-timur-reply]

Also happening with POST on https://registry.npmjs.org/-/npm/v1/security/audits/quick

[lppedd]

Another Primeagen npm video incoming about how Microsoft blocked CIs worldwide.

/s (but not really)

[samus-aran]

Hey everyone! The teams are aware of this and are currently investigating. When we have any updates we will post here edited (and https://status.npmjs.org/)

[tmc101]

Maybe update https://status.npmjs.org/

[singlewind]

I have tried and tested multiple networks because the status page didn't say audit endpoint have issue. Now, I can relief.

[Elnadrion]

@tmc101 +1, It'd be nice to see the incident reflected on the npm status page, which still shows everything as "operational" -_-

[ArSn]

What is the status site even for when outages like this are not reported there? I have been digging for some time as well now, entirely wasted time because I trusted the status site 😞

[samus-aran]

Status page updated. 👍 We'll update further when we have more information.

[samus-aran]

Hey everyone! We have updated the status page that this has now been resolved. Please let us know if this still impacts you. Thank you all again for raising this. I will close this discussion as it is now outdated - any new incidents or issues please raise a new discussion 👍

https://status.npmjs.org/incidents/l4f53bbr9200