# @rushstack/eslint-plugin-security

> An ESLint plugin providing rules that identify common security vulnerabilities for browser applications, Node.js tools, and Node.js services

Latest version **0.14.3** (published 2026-09-14) · MIT license · 0 weekly downloads

## Install

```sh
npm install @rushstack/eslint-plugin-security
pnpm add @rushstack/eslint-plugin-security
yarn add @rushstack/eslint-plugin-security
bun add @rushstack/eslint-plugin-security
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; recently updated; high maintenance score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.14.3 |
| Published | 2026-09-14 |
| First published | 2020-09-19 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=20.9.0 |
| Dependencies | 2 |
| Unpacked size | 38 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 6500 |
| Maintainers | rushstack-admin, odspnpm, octogonz, microsoft1es |
| Keywords | eslint, eslint-config, security |

## Links

- npm: https://www.npmjs.com/package/@rushstack/eslint-plugin-security
- Repository: https://github.com/microsoft/rushstack
- Homepage: https://rushstack.io
- Issues: https://github.com/microsoft/rushstack/issues
- npm.io page: https://npm.io/package/@rushstack/eslint-plugin-security

## Dependencies (2)

- [@rushstack/tree-pattern](https://npm.io/package/@rushstack/tree-pattern.md) 0.4.1
- [@typescript-eslint/utils](https://npm.io/package/@typescript-eslint/utils.md) ~8.56.1

## Alternatives

- [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads
- [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads
- [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads
- [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads
- [@pandacss/eslint-plugin](https://npm.io/package/@pandacss/eslint-plugin.md) — 18.7K weekly downloads

## Recent versions

- 0.14.3 (latest) — 2026-09-14
- 0.14.2 — 2026-02-25
- 0.14.1 — 2026-02-20
- 0.14.0 — 2026-02-19
- 0.13.0 — 2025-10-13
- 0.12.0 — 2025-10-03
- 0.11.0 — 2025-06-26
- 0.10.0 — 2025-03-11
- 0.9.0 — 2025-03-01
- 0.8.3 — 2024-09-19
- 0.8.2 — 2024-07-27
- 0.8.1 — 2024-02-17
- 0.8.0 — 2024-01-16
- 0.7.1 — 2023-09-26
- 0.7.0 — 2023-09-15
- … 18 more at https://npm.io/package/@rushstack/eslint-plugin-security/versions

## README

# @rushstack/eslint-plugin-security

This plugin implements a collection of security rules for ESLint.

Our ambition is to eventually provide a comprehensive set of recommended security rules for:
- web browser applications
- Node.js tools
- Node.js services

If you would like to request or contribute a new security rule, you are encouraged to
[create a GitHub issue](https://github.com/microsoft/rushstack/issues) in the
[Rush Stack](https://rushstack.io/) monorepo where this project is developed.
Thanks!

## `@rushstack/security/no-unsafe-regexp`

Require regular expressions to be constructed from string constants rather than dynamically
building strings at runtime.

#### Rule Details

Regular expressions should be constructed from string constants. Dynamically building strings at runtime may
introduce security vulnerabilities, performance concerns, and bugs involving incorrect escaping of special characters.

#### Examples

The following patterns are considered problems when `@rushstack/security/no-unsafe-regexp` is enabled:

```ts
function parseRestResponse(request: ICatalogRequest,
  items: ICatalogItem[]): ICatalogItem[] {

  // Security vulnerability: A malicious user could invoke the REST service using a
  // "searchPattern" with a complex RegExp that causes a denial of service.
  const regexp: RegExp = new RegExp(request.searchPattern);
  return items.filter(item => regexp.test(item.title));
}
```

```ts
function hasExtension(filePath: string, extension: string): boolean {
  // Escaping mistake: If the "extension" string contains a special character such as ".",
  // it will be interpreted as a regular expression operator. Correctly escaping an arbitrary
  // string is a nontrivial problem due to RegExp implementation differences, as well as contextual
  // issues (since which characters are special changes inside RegExp nesting constructs).
  // In most cases, this problem is better solved without regular expressions.
  const regexp: RegExp = new RegExp(`\.${extension}$`);
  return regexp.test(filePath);
}
```

The following patterns are NOT considered problems:

```ts
function isInteger(s: string): boolean {
  return /[0-9]+/.test(s);
}
```

```ts
function isInteger(s: string): boolean {
  return new RegExp('[0-9]+').test(s);
}
```

## Links

- [CHANGELOG.md](
  https://github.com/microsoft/rushstack/blob/main/eslint/eslint-plugin-security/CHANGELOG.md) - Find
  out what's new in the latest version

`@rushstack/eslint-plugin-security` is part of the [Rush Stack](https://rushstack.io/) family of projects.

---
_Source: https://npm.io/package/@rushstack/eslint-plugin-security · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._