\n```\n\n[run this code](https://stackblitz.com/edit/fpjs-5-cdn?file=index.html&devtoolsheight=100)\n\n### resources\n\n\ud83d\udcd5 api reference\n\n\u269b\ufe0f [sample usage with react on the stackblitz platform](https://stackblitz.com/edit/fingerprintjs-react-demo)\n\n\ud83d\udd11 fingerprintjs licensing\n\n## limitations\n\n### accuracy\n\nsince fingerprintjs processes and generates fingerprints in the browser itself, the accuracy is significantly lower than in the [commercial version](https://fingerprint.com/pricing)\n\n### security\n\nbecause fingerprints are generated and processed in the browser, they are vulnerable to spoofing and reverse engineering.\n\n## want higher accuracy? upgrade to fingerprint identification for free\n\nfingerprintjs is great for getting started, but if you need production-grade accuracy for web or mobile, consider [**fingerprint identification**](https://fingerprint.com/products/identification/). you can [**sign up for a free account**](https://dashboard.fingerprint.com/signup) to get started.\n\nfingerprint identification is a **closed-source, commercial** device intelligence platform designed to prevent fraud and improve user experiences. it's an enhanced version of fingerprintjs, fully redesigned to solve the most challenging identification use cases. unlike fingerprintjs, it combines client-side signal collection with server-side processing. it collects over 100 browser and device signals, which are then analyzed server-side alongside network-level data, including signals that are entirely invisible to the browser, allowing it to reliably deduplicate visitors with identical devices. this server-side processing also validates that signals have not been tampered with or replayed, and generates a stable visitor identifier with **industry-leading accuracy** that is significantly harder to spoof than a purely client-side fingerprint.\n\nupgrading for free also unlocks access to the [fingerprint mcp server](https://docs.fingerprint.com/docs/mcp-server), letting your ai coding assistant build and interact directly with fingerprint. to access [smart signals](https://fingerprint.com/products/smart-signals/) (device signals such as bot detection, vpn detection, and browser tampering detection), a 14-day free trial of the full platform is available.\n\ncheck out our comparison table for a detailed breakdown of the differences between fingerprintjs and fingerprint identification.\n\n### fingerprint identification resources\n\n\ud83c\udf7f [fingerprint identification live demo](https://demo.fingerprint.com/playground)\n\n\ud83d\udcd5 [fingerprint identification documentation](https://dev.fingerprint.com)\n\n\u25b6\ufe0f [video: use fingerprint identification to prevent multiple signups by the same user](https://www.youtube.com/watch?v=jwx9p5_jzn8)\n\n\u23f1\ufe0f [how to upgrade from fingerprintjs to fingerprint identification in 30 seconds](https://dev.fingerprint.com/docs/migrating-from-fingerprintjs-to-fingerprint-pro)\n\n## migrating to v5\n\n| migrating from | migration guide | documentation |\n|----------|-----------|-----------|\n| **v4** | migrating from v4 to v5 | [v4 documentation](https://github.com/fingerprintjs/fingerprintjs/tree/v4) |\n| **v3** | migrating from v3 to v5 | [v3 documentation](https://github.com/fingerprintjs/fingerprintjs/tree/v3) |\n\n## version policy\n\nsee the compatibility policy for the api and visitor identifiers in the version policy guide.\n\n## supported browsers\n\nthe library supports all popular browsers. see more details and learn how to run the library in old browsers in the browser support guide.\n\n## where to get support\n\nusing [issues](https://github.com/fingerprintjs/fingerprintjs/issues) and [discussions](https://github.com/fingerprintjs/fingerprintjs/discussions) publicly will help the community and other users with similar issues.\n\nyou can also join our [discord server](https://discord.gg/ad6r2tthvx) to ask questions, share feedback, and connect with other developers.\n\nif you require private support for fingerprintjs, please email us at [oss-support@fingerprint.com](mailto:oss-support@fingerprint.com).\n\n## contributing\n\nsee the contribution guidelines to learn how to contribute to the project or run the project locally.\nplease read it carefully before making a pull request.", "installation_instructions": null, "categories": [ "Everything" ], "owners": [], "owner": null, "code_snippets": {}, "evaluation_results": [], "found_via_ownership_request": false, "hosting_eligible": false, "knative_enabled": false, "security_scans": [ { "repo_url": "https://github.com/fingerprintjs/fingerprintjs", "repo_name": "fingerprintjs", "score": 78, "risk_level": "moderate", "score_explanation": "Score starts at 100, deducts points for security issues, and adds points for security best practices", "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "mcp_app_id": "5afa7f97-fe30-4348-bd0d-aa521ca41ddf", "scan_time": "2026-05-05T12:13:01.958559+00:00", "created_at": "2026-05-05T12:13:01.965192+00:00", "updated_at": "2026-05-05T12:13:01.965192+00:00", "findings": [], "vulnerabilities": [ { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "body-parser", "severity": "low", "references": [], "vulnerability_id": "b2dd4df5-9d64-46a0-a046-2b1eaa4da288", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['qs']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "browserify-sign", "severity": "low", "references": [], "vulnerability_id": "1c2a1479-2717-42b1-8f8b-5538ed17a829", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['elliptic']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "compression", "severity": "low", "references": [], "vulnerability_id": "f88f0861-a78a-4b16-a5c4-00f0ddaad417", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['on-headers']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "cookie", "severity": "low", "references": [], "vulnerability_id": "11b66c2a-20bd-4400-8cbf-9496ff295877", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1103907, 'name': 'cookie', 'dependency': 'cookie', 'title': 'cookie accepts cookie name, path, and domain with out of bounds characters', 'url': 'https://github.com/advisories/GHSA-pxg6-pf52-xh8x', 'severity': 'low', 'cwe': ['CWE-74'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '<0.7.0'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "create-ecdh", "severity": "low", "references": [], "vulnerability_id": "bb9ed9c4-2c4d-4a1b-a98e-8e1aae3d9e7b", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['elliptic']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "crypto-browserify", "severity": "low", "references": [], "vulnerability_id": "bdffd1a0-8c05-44cc-bb44-6d4758f377fe", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['browserify-sign', 'create-ecdh']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "@fpjs-incubator/broyster", "severity": "low", "references": [], "vulnerability_id": "b9f94701-9a6c-4340-831c-9b5e82920f8a", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['karma-typescript']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "diff", "severity": "low", "references": [], "vulnerability_id": "60cb3b49-0a98-46c1-be96-95ae60376a75", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1112704, 'name': 'diff', 'dependency': 'diff', 'title': 'jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch', 'url': 'https://github.com/advisories/GHSA-73rr-hh4g-fpgx', 'severity': 'low', 'cwe': ['CWE-400', 'CWE-1333'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '>=4.0.0 <4.0.4'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "elliptic", "severity": "low", "references": [], "vulnerability_id": "72d73c93-0419-4e86-8c5f-c796228a6569", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1112030, 'name': 'elliptic', 'dependency': 'elliptic', 'title': 'Elliptic Uses a Cryptographic Primitive with a Risky Implementation', 'url': 'https://github.com/advisories/GHSA-848j-6mx2-7j84', 'severity': 'low', 'cwe': ['CWE-1240'], 'cvss': {'score': 5.6, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}, 'range': '<=6.6.1'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "engine.io", "severity": "low", "references": [], "vulnerability_id": "a0264a40-4f11-41a8-834e-ee17c8768dce", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['cookie']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "karma-typescript", "severity": "low", "references": [], "vulnerability_id": "cb5bbf6a-f241-422f-815b-03d1b0477c76", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['crypto-browserify']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "on-headers", "severity": "low", "references": [], "vulnerability_id": "ac534406-47b6-406f-a921-5b81bed7128d", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1106812, 'name': 'on-headers', 'dependency': 'on-headers', 'title': 'on-headers is vulnerable to http response header manipulation', 'url': 'https://github.com/advisories/GHSA-76c9-3jph-rj3q', 'severity': 'low', 'cwe': ['CWE-241'], 'cvss': {'score': 3.4, 'vectorString': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'}, 'range': '<1.1.0'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "socket.io", "severity": "low", "references": [], "vulnerability_id": "e708959b-1edc-4fcd-b0fa-3aece2016d88", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['engine.io']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "@rollup/plugin-terser", "severity": "high", "references": [], "vulnerability_id": "1606f77d-fb03-4ae8-aa78-49ef1104d0ca", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['serialize-javascript']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "express", "severity": "high", "references": [], "vulnerability_id": "eb6810c6-2c17-4f49-83da-8c509672564a", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['body-parser', 'path-to-regexp', 'qs']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "lodash", "severity": "high", "references": [], "vulnerability_id": "0a52a822-1ab7-4396-a139-7a8f9e7955a2", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1115806, 'name': 'lodash', 'dependency': 'lodash', 'title': 'lodash vulnerable to Code Injection via `_.template` imports key names', 'url': 'https://github.com/advisories/GHSA-r5fr-rjxr-66jc', 'severity': 'high', 'cwe': ['CWE-94'], 'cvss': {'score': 8.1, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}, 'range': '>=4.0.0 <=4.17.23'}, {'source': 1115810, 'name': 'lodash', 'dependency': 'lodash', 'title': 'lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`', 'url': 'https://github.com/advisories/GHSA-f23m-r3pf-42rh', 'severity': 'moderate', 'cwe': ['CWE-1321'], 'cvss': {'score': 6.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'}, 'range': '<=4.17.23'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "path-to-regexp", "severity": "high", "references": [], "vulnerability_id": "c1266234-de68-459b-a75c-4eeb83715171", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1115527, 'name': 'path-to-regexp', 'dependency': 'path-to-regexp', 'title': 'path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters', 'url': 'https://github.com/advisories/GHSA-37ch-88jc-xwx2', 'severity': 'high', 'cwe': ['CWE-1333'], 'cvss': {'score': 7.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '<0.1.13'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "rollup-plugin-license", "severity": "high", "references": [], "vulnerability_id": "c0a32e2c-7b32-4963-b672-200f9bb4df06", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['lodash']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "serialize-javascript", "severity": "high", "references": [], "vulnerability_id": "e0d32893-6e9c-4440-9a80-2ee82a9bf39d", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1113686, 'name': 'serialize-javascript', 'dependency': 'serialize-javascript', 'title': 'Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()', 'url': 'https://github.com/advisories/GHSA-5c6j-r48x-rmvq', 'severity': 'high', 'cwe': ['CWE-96'], 'cvss': {'score': 8.1, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}, 'range': '<=7.0.2'}, {'source': 1115723, 'name': 'serialize-javascript', 'dependency': 'serialize-javascript', 'title': 'Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects', 'url': 'https://github.com/advisories/GHSA-qj8w-gfj5-8c6v', 'severity': 'moderate', 'cwe': ['CWE-400', 'CWE-834'], 'cvss': {'score': 5.9, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}, 'range': '<7.0.5'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "socket.io-parser", "severity": "high", "references": [], "vulnerability_id": "4641c6c3-68e9-4b1a-b6c3-b040c338b40d", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1115154, 'name': 'socket.io-parser', 'dependency': 'socket.io-parser', 'title': 'socket.io allows an unbounded number of binary attachments', 'url': 'https://github.com/advisories/GHSA-677m-j7p3-52f9', 'severity': 'high', 'cwe': ['CWE-754'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '>=4.0.0 <4.2.6'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "terser-webpack-plugin", "severity": "high", "references": [], "vulnerability_id": "fb1adbdd-10f2-4b3b-9bf8-cde2119bbdd9", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['serialize-javascript']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "ajv", "severity": "moderate", "references": [], "vulnerability_id": "9c4e49ed-756a-4ff9-9ddf-a36ec0354319", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1113714, 'name': 'ajv', 'dependency': 'ajv', 'title': 'ajv has ReDoS when using `$data` option', 'url': 'https://github.com/advisories/GHSA-2g4f-4pwh-qvx6', 'severity': 'moderate', 'cwe': ['CWE-400', 'CWE-1333'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '<6.14.0'}, {'source': 1113715, 'name': 'ajv', 'dependency': 'ajv', 'title': 'ajv has ReDoS when using `$data` option', 'url': 'https://github.com/advisories/GHSA-2g4f-4pwh-qvx6', 'severity': 'moderate', 'cwe': ['CWE-400', 'CWE-1333'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '>=7.0.0-alpha.0 <8.18.0'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "brace-expansion", "severity": "moderate", "references": [], "vulnerability_id": "0d14f0ad-2408-47af-80c8-1e04a65f5f2b", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1105443, 'name': 'brace-expansion', 'dependency': 'brace-expansion', 'title': 'brace-expansion Regular Expression Denial of Service vulnerability', 'url': 'https://github.com/advisories/GHSA-v6h2-p8h4-qcjw', 'severity': 'low', 'cwe': ['CWE-400'], 'cvss': {'score': 3.1, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}, 'range': '>=1.0.0 <=1.1.11'}, {'source': 1115540, 'name': 'brace-expansion', 'dependency': 'brace-expansion', 'title': 'brace-expansion: Zero-step sequence causes process hang and memory exhaustion', 'url': 'https://github.com/advisories/GHSA-f886-m6hf-6m8v', 'severity': 'moderate', 'cwe': ['CWE-400'], 'cvss': {'score': 6.5, 'vectorString': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}, 'range': '<1.1.13'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "qs", "severity": "moderate", "references": [], "vulnerability_id": "b1dbe915-4681-4aee-9a3a-c95c50babd04", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1113161, 'name': 'qs', 'dependency': 'qs', 'title': \"qs's arrayLimit bypass in comma parsing allows denial of service\", 'url': 'https://github.com/advisories/GHSA-w7fw-mjwx-w883', 'severity': 'low', 'cwe': ['CWE-20'], 'cvss': {'score': 3.7, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}, 'range': '>=6.7.0 <=6.14.1'}, {'source': 1113719, 'name': 'qs', 'dependency': 'qs', 'title': \"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion\", 'url': 'https://github.com/advisories/GHSA-6rw7-vpxm-498p', 'severity': 'moderate', 'cwe': ['CWE-20'], 'cvss': {'score': 3.7, 'vectorString': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}, 'range': '<6.14.1'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "sockjs", "severity": "moderate", "references": [], "vulnerability_id": "2980bd87-0f9a-4257-834a-8e706a8ee558", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['uuid']", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "uuid", "severity": "moderate", "references": [], "vulnerability_id": "976b05cd-18d4-49d4-a1ef-7a7466bf8657", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "[{'source': 1116970, 'name': 'uuid', 'dependency': 'uuid', 'title': 'uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided', 'url': 'https://github.com/advisories/GHSA-w5hq-g745-h8pq', 'severity': 'moderate', 'cwe': ['CWE-787', 'CWE-1285'], 'cvss': {'score': 0, 'vectorString': None}, 'range': '<14.0.0'}]", "created_at": "2026-05-05T12:13:01.965192+00:00" }, { "scan_id": "ac77c210-9363-4ecc-8e54-0074df195acd", "package_name": "webpack-dev-server", "severity": "moderate", "references": [], "vulnerability_id": "6191d557-0228-4df4-ae70-7392b2058fce", "vulnerable_version": "unknown", "fixed_version": "unknown", "description": "['sockjs']", "created_at": "2026-05-05T12:13:01.965192+00:00" } ] } ] } }