Plain npm audit fix applies remediations that fit inside the version ranges you already declared. Adding the force option lets npm install versions outside those ranges, including semver major changes, which can break your code. Use the plain command freely and treat force as a last resort.
What the plain command does
npm audit fix runs a full install under the hood and updates the package tree where a fix is available within your stated ranges. The documentation notes that some vulnerabilities cannot be fixed automatically. When that happens, the command tells you and leaves them alone.
npm audit
npm audit fix
Run the first to see the report, then the second to apply what is safe. Review the diff of your lockfile before you commit it.
What force changes
The force option allows modules outside your declared range, including major version changes. The npm documentation strongly advises against using it without a clear plan. A major version is allowed to break the public interface, so the fix for a vulnerability may arrive together with changed behaviour.
Why a break matters
A security fix that crashes production on Friday is not a win. Major upgrades can remove functions, change defaults or require a newer runtime. Tests are your safety net, so run them before and after, and read the changelog of anything that jumped a major version.
A safer path than force
- Run the plain fix and commit the result.
- Look at what remains. Note the vulnerable package and which of your direct dependencies brings it in.
- Upgrade that direct dependency by hand, one at a time, running tests after each.
- If no upgrade exists, check whether the vulnerable code is reachable in your app, and record the decision with a date.
When force is reasonable
A throwaway prototype, or a project with strong test coverage and a branch you can discard, is a fair place to try it. Do it on a branch, never straight on main.
Quick check
Will audit fix change my package.json?
It can update ranges when it installs a newer version that satisfies the fix. Always review changes to both the manifest and the lockfile.
Does a clean audit after fixing mean I am secure?
It means the registry knows of no remaining advisories for your tree. It says nothing about unknown flaws or about how your own code uses the libraries.
Sources
Last reviewed: 19 October 2026.
