[BUG] Output of `npm audit` is incomplete (vulnerability missing)

[FeBe95]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Output of npm audit doesn't always list all vulnerabilities when using default output format.

Expected Behavior

Output of npm audit always list all vulnerabilities when using default output format.

Steps To Reproduce

1. Install vulnerable package:

   npm install html2pdf.js@0.10.2
   

2. Run audit (JSON output format):

   npm audit --json
   

3. Observe output (JSON format):

   👉 Show/hide output 👈

   {
     "auditReportVersion": 2,
     "vulnerabilities": {
       "dompurify": {
         "name": "dompurify",
         "severity": "moderate",
         "isDirect": false,
         "via": [
           {
             "source": 1102259,
             "name": "dompurify",
             "dependency": "dompurify",
             "title": "DOMPurify allows Cross-site Scripting (XSS)",
             "url": "https://github.com/advisories/GHSA-vhxf-7vqr-mrjg",
             "severity": "moderate",
             "cwe": [
               "CWE-79"
             ],
             "cvss": {
               "score": 4.5,
               "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"
             },
             "range": "<3.2.4"
           }
         ],
         "effects": [
           "jspdf"
         ],
         "range": "<3.2.4",
         "nodes": [
           "node_modules/dompurify"
         ],
         "fixAvailable": true
       },
       "html2pdf.js": {
         "name": "html2pdf.js",
         "severity": "high",
         "isDirect": true,
         "via": [
           "jspdf"
         ],
         "effects": [],
         "range": "<=0.10.2",
         "nodes": [
           "node_modules/html2pdf.js"
         ],
         "fixAvailable": true
       },
       "jspdf": {
         "name": "jspdf",
         "severity": "high",
         "isDirect": false,
         "via": [
           {
             "source": 1103308,
             "name": "jspdf",
             "dependency": "jspdf",
             "title": "jsPDF Bypass Regular Expression Denial of Service (ReDoS)",
             "url": "https://github.com/advisories/GHSA-w532-jxjh-hjhj",
             "severity": "high",
             "cwe": [
               "CWE-400",
               "CWE-770"
             ],
             "cvss": {
               "score": 0,
               "vectorString": null
             },
             "range": "<3.0.1"
           },
           "dompurify"
         ],
         "effects": [
           "html2pdf.js"
         ],
         "range": "<=3.0.0",
         "nodes": [
           "node_modules/jspdf"
         ],
         "fixAvailable": true
       }
     },
     "metadata": {
       "vulnerabilities": {
         "info": 0,
         "low": 0,
         "moderate": 1,
         "high": 2,
         "critical": 0,
         "total": 3
       },
       "dependencies": {
         "prod": 14,
         "dev": 0,
         "optional": 10,
         "peer": 0,
         "peerOptional": 0,
         "total": 23
       }
     }
   }

4. Run audit (default output format):

   npm audit
   

5. Observe output (default format):

   👉 Show/hide output 👈

   dompurify  <3.2.4
   Severity: moderate
   DOMPurify allows Cross-site Scripting (XSS) - https://github.com/advisories/GHSA-vhxf-7vqr-mrjg
   fix available via `npm audit fix`
   node_modules/dompurify
     jspdf  <=3.0.0
     Depends on vulnerable versions of dompurify
     node_modules/jspdf
       html2pdf.js  <=0.10.2
       Depends on vulnerable versions of jspdf
       node_modules/html2pdf.js
   
   
   3 vulnerabilities (1 moderate, 2 high)
   

6. Look at differences:

   • JSON output format: List shows 1 moderate and 2 high vulnerabilities.
   • Default output format: List shows 1 moderate vulnerability.
   • Default output format: Summary states 1 moderate and 2 high vulnerabilities.

Environment

• npm: 11.2.0
• Node.js: v22.14.0
• OS Name: Debian GNU/Linux 12 (bookworm), also reproduced on Windows & MacOS
• System Model Name: -
• npm config:

; "env" config from environment

cache = "/root/.cache/npm"
store-dir = "/root/.cache/pnpm"

; node bin location = /usr/local/share/nvm/versions/node/v22.14.0/bin/node
; node version = v22.14.0
; npm local prefix = /project/workspace
; npm version = 11.2.0
; cwd = /project/workspace
; HOME = /root
; Run `npm config ls -l` to show all defaults.

[v-kchindam-infy]

The JSON and default text outputs of npm audit convey the same vulnerability data but in different formats.
JSON Output: Lists vulnerabilities explicity with metadata liike server, CVSS scores and affected the nodes. it correctly reports 1 Moderate and 2 high vulnerabilities.
Default Text Output: Lists vulnerabilities by affected packages, which may not group severities explicitly but still provides the correct count in the summary. "3 vulnerabilties(1 moderate, 2 high).
The perceived mismatch is due to the presentation style, not a data inconsistency. Both outputs are accurate and there is no issue

[FeBe95]

The perceived mismatch is due to the presentation style

I understand that there might be some differences, and not every single (sub-)dependent vulnerability will be listed with the default output style.

What I do not understand is that none of the "high" vulnerabilities are reported in the default output in the case above. Yes, the count shows that they are indeed detected. The command also exits with a non-zero code. Though, by looking at the output, I would not know how to fix the high vulnerabilities. There is no package name, no link, not anything listed about them.

I would expect to see at least one of the two packages in the output:

• Either the direct dependency html2pdf.js
• Or the sub/transitive dependency jspdf, the one with the actual vulnerability