How to fix npm ERR! code ENOAUDIT npm ERR! Your configured registry does not support audit requests in npm

npmINTERMEDIATEMEDIUMUpdated Dec 5, 2025· 198 views

This ENOAUDIT error occurs when your private npm registry doesn't support the audit API. Use --registry flag to audit against the public npm registry or upgrade your private registry.

Quick fix

Fixes ENOAUDIT

# Disable audit for a single install
npm install --no-audit

# Disable audit globally (sets in .npmrc)
npm set audit false

# Or manually edit ~/.npmrc and add:
audit=false
  1. Disable audit for immediate relief (quick fix)
  2. Override registry for audit to use public npm
  3. Upgrade your private registry to support audit
  4. Configure authentication if audit endpoint requires login
npm — error
# Disable audit for a single install
npm install --no-audit
# Disable audit globally (sets in .npmrc)
npm set audit false
# Or manually edit ~/.npmrc and add:
audit=false
npm ERR! code ENOAUDIT
npm ERR! Your configured registry does not support audit requests

What this error means

The npm audit command requires the registry to implement the security audit API endpoint. When your configured registry (often a private one like Verdaccio, Artifactory, or Nexus) doesn't support audit requests, npm cannot check your dependencies for known vulnerabilities. This is a mismatch between npm's audit feature and the registry's capabilities—most private registries were built before npm audit existed or didn't implement the necessary security endpoints. The error indicates that npm successfully reached your registry but found it doesn't support the audit endpoint.

Typical symptoms

  • Running 'npm install' or 'npm audit' fails with 'code ENOAUDIT'
  • Error message states: 'Your configured registry does not support audit requests'
  • npm install completes but warns to run 'npm audit' for security details
  • CI/CD pipelines fail when they execute 'npm audit' as a validation step
  • Works fine when switching to public npm registry but fails with private registry

Common causes

  1. Private npm registry (Verdaccio, ProGet, etc.) doesn't implement the npm audit API endpoint
  2. Artifactory or Nexus Repository OSS version predates npm audit support
  3. Network proxy or firewall blocking access to the audit endpoint on your registry
  4. Misconfigured .npmrc pointing to a registry that never supported audit requests
  5. npm version mismatch—very old npm versions may have different audit behavior
  6. Registry requires authentication to access audit endpoint but credentials aren't configured

How to fix "npm ERR! code ENOAUDIT npm ERR! Your configured registry does not support audit requests"

1Disable audit for immediate relief (quick fix)

If you need to unblock installations immediately, disable the audit check:

bash
# Disable audit for a single install
npm install --no-audit

# Disable audit globally (sets in .npmrc)
npm set audit false

# Or manually edit ~/.npmrc and add:
audit=false

Note: This skips vulnerability checks, so have an alternative security scanning process.

2Override registry for audit to use public npm

Run npm audit against the public npm registry while keeping your private registry for package installations:

bash
# Run audit against public registry
npm audit --registry=https://registry.npmjs.org

# Or use the --audit-level flag to ignore low/moderate vulnerabilities
npm audit --registry=https://registry.npmjs.org --audit-level=high
3Upgrade your private registry to support audit

If using Artifactory, Nexus, or Verdaccio, check your version and upgrade:

Artifactory: npm audit is supported natively. Ensure you have at least one remote repository pointing to registry.npmjs.org.

Nexus Repository Manager: As of version 3.23.0+, npm audit is supported. Upgrade to the latest version.

Verdaccio: Upgrade to the latest version (5.x). The audit command works with recent versions:

bash
npm install -g verdaccio@latest
4Configure authentication if audit endpoint requires login

Some enterprise registries require authentication for audit endpoints. Configure credentials in your .npmrc:

bash
# For .npmrc in your project root or ~/.npmrc
registry=https://your-private-registry.com
//your-private-registry.com:_authToken=your-token-here

# For Artifactory with username/password
_auth=$(echo -n "username:password" | base64)
5Clean install to ensure lock file is valid

Corrupted lock files can cause audit issues. Perform a clean reinstall:

bash
# Remove lock files and node_modules
rm -rf package-lock.json node_modules

# Reinstall everything
npm install

# Then try audit
npm audit

If you get EAUDITNOLOCK error, create the lock file explicitly:

bash
npm install --package-lock-only
npm audit
6For containerized/CI environments: use npm audit --registry flag

In Docker or CI/CD, use environment-specific registry configuration:

dockerfile
# Docker example
FROM node:18
WORKDIR /app
COPY package*.json ./
# Install from private registry
RUN npm ci
# Audit against public registry
RUN npm audit --registry=https://registry.npmjs.org || true

The || true allows the build to continue even if audit finds vulnerabilities.

Advanced notes

For enterprise environments, consider these alternatives: (1) JFrog Xray with Artifactory provides vulnerability scanning without depending on npm audit. (2) Setup an npm-audit-proxy to bridge the gap between your private registry and npmjs.org. (3) Verdaccio supports uplinks to npmjs.org; configure it to forward audit requests. (4) For air-gapped environments without internet access, use tools like OWASP Dependency-Check, Snyk, or commercial alternatives for vulnerability scanning on private packages.

Frequently asked questions

What does "ENOAUDIT" mean?
The npm audit command requires the registry to implement the security audit API endpoint. When your configured registry (often a private one like Verdaccio, Artifactory, or Nexus) doesn't support audit requests, npm cannot check your dependencies for known vulnerabilities. This is a mismatch between npm's audit feature and the registry's capabilities—most private registries were built before npm audit existed or didn't implement the necessary security endpoints.
How do I fix "ENOAUDIT"?
This ENOAUDIT error occurs when your private npm registry doesn't support the audit API. Use --registry flag to audit against the public npm registry or upgrade your private registry.
What causes "ENOAUDIT"?
Private npm registry (Verdaccio, ProGet, etc.) doesn't implement the npm audit API endpoint Artifactory or Nexus Repository OSS version predates npm audit support Network proxy or firewall blocking access to the audit endpoint on your registry
Is the "ENOAUDIT" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading