How to fix npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than specified --audit-level in npm

npmINTERMEDIATEMEDIUMUpdated Dec 3, 2025· 131 views

The EAUDITLEVELFAIL error occurs when npm audit finds security vulnerabilities at or above your specified --audit-level threshold. This is intentional behavior to prevent vulnerable dependencies in CI/CD pipelines.

Quick fix

Fixes npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than specified --audit-level

# See detailed vulnerability report
npm audit

# Get JSON output for parsing
npm audit --json
  1. Review the audit report
  2. Try automatic fixes
  3. Filter to production dependencies only
  4. Adjust the audit level threshold
npm — error
# See detailed vulnerability report
npm audit
# Get JSON output for parsing
npm audit --json
npm ERR! code EAUDITLEVELFAIL
npm ERR! audit level is higher than specified --audit-level

What this error means

This error is a security feature, not a bug. When you run npm audit or npm install with an --audit-level flag, npm checks all dependencies for known security vulnerabilities. If any vulnerability is found at or above your threshold (low, moderate, high, or critical), npm exits with a non-zero code to fail your build. The error is commonly encountered in CI/CD pipelines where you've set strict security requirements. For example, if you set --audit-level=moderate, npm will fail if it finds any moderate, high, or critical vulnerabilities. Starting with npm v7, both npm install and npm audit respect the --audit-level setting. In npm v6, only npm audit used this flag while npm install ignored it.

Typical symptoms

  • Build fails in CI pipeline but succeeds locally without the flag
  • npm install exits with code 1 without clear explanation
  • npm audit report shows moderate/high/critical vulnerabilities
  • Error appears after adding new dependencies

Common causes

  1. Dependencies have known CVE security vulnerabilities
  2. Transitive dependencies (dependencies of dependencies) are vulnerable
  3. Development dependencies have vulnerabilities
  4. Packages haven't been updated in months
  5. npm version upgrade changed audit behavior (npm 6 vs 7+)

How to fix "npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than specified --audit-level"

1Review the audit report

First, understand what vulnerabilities exist:

bash
# See detailed vulnerability report
npm audit

# Get JSON output for parsing
npm audit --json

Look for the severity levels and affected packages. Note which packages are direct dependencies vs. transitive.

2Try automatic fixes

Let npm attempt to update packages to patched versions:

bash
# Preview what would be fixed
npm audit fix --dry-run

# Apply compatible fixes (patch/minor versions)
npm audit fix

# Force major version updates (may break code)
npm audit fix --force

After fixing, run npm audit again to verify.

3Filter to production dependencies only

Development-only vulnerabilities are often lower risk. Audit only production dependencies:

bash
# Audit production dependencies only
npm audit --production

# In CI/CD
npm audit --production --audit-level=high

Add to package.json scripts:

json
{
  "scripts": {
    "security:prod": "npm audit --production --audit-level=moderate"
  }
}
4Adjust the audit level threshold

If you need to proceed with known moderate vulnerabilities, raise the threshold:

bash
# Only fail on high or critical
npm audit --audit-level=high

# Only fail on critical
npm audit --audit-level=critical

Set permanently in .npmrc:

bash
audit-level=high

Warning: This trades security for convenience. Only use for development or non-critical projects.

5Use package overrides for transitive dependencies

For npm 8.3+, force safe versions of vulnerable transitive dependencies:

json
{
  "overrides": {
    "vulnerable-package": ">=2.0.5",
    "postcss": ">=8.4.31",
    "nth-check": ">=2.0.1"
  }
}

Then reinstall:

bash
npm install
npm audit
6Use audit-ci for advanced CI control

For complex scenarios, use IBM's audit-ci tool to allowlist specific advisories:

bash
npm install --save-dev audit-ci

Create audit-ci.jsonc:

json
{
  "moderate": true,
  "allowlist": [
    1234567
  ]
}

Run in CI:

bash
npx audit-ci --config ./audit-ci.jsonc

Advanced notes

The --audit-level flag doesn't filter output—it only changes the exit code threshold. Vulnerabilities are still reported; you just control when the build fails.

In npm v6, npm install didn't respect --audit-level, but npm v7+ changed this behavior. If upgrading npm versions, expect builds that previously passed to start failing if vulnerabilities exist.

Never disable audit entirely in production builds. If you must bypass temporarily, document the reason and set a deadline to address the vulnerabilities.

Frequently asked questions

What does "npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than spec" mean?
This error is a security feature, not a bug. When you run npm audit or npm install with an --audit-level flag, npm checks all dependencies for known security vulnerabilities. If any vulnerability is found at or above your threshold (low, moderate, high, or critical), npm exits with a non-zero code to fail your build.
How do I fix "npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than spec"?
The EAUDITLEVELFAIL error occurs when npm audit finds security vulnerabilities at or above your specified --audit-level threshold. This is intentional behavior to prevent vulnerable dependencies in CI/CD pipelines.
What causes "npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than spec"?
Dependencies have known CVE security vulnerabilities Transitive dependencies (dependencies of dependencies) are vulnerable Development dependencies have vulnerabilities
Is the "npm ERR! code EAUDITLEVELFAIL npm ERR! audit level is higher than spec" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading