How to fix npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You cannot publish over the previously published versions in npm

npmBEGINNERMEDIUMUpdated Dec 5, 2025· 136 views

This error occurs when you attempt to publish an npm package with a version number that already exists in the registry. npm enforces version immutability for security and ecosystem stability—once a version is published, it can never be overwritten or reused.

Quick fix

Fixes npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You cannot publish over the previously published versions

npm info your-package-name
  1. Check the current published version
  2. Increment the version number
  3. Verify the new version before publishing
  4. Publish the new version
npm — error
npm info your-package-name
npm ERR! code E403
npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You cannot publish over the previously published versions

What this error means

This error occurs when you attempt to publish an npm package with a name and version combination that already exists in the registry. npm enforces version immutability for security and ecosystem stability—once a version is published, it can never be overwritten or reused, even if it's unpublished. This is a deliberate design choice to prevent supply-chain attacks where a malicious actor could replace legitimate code with compromised code while keeping the same version number. The immutability guarantee ensures that once you depend on a specific version, the code behind that version will never change. This protection applies to both public and scoped packages on the npm registry.

Typical symptoms

  • npm ERR! code E403 with '403 Forbidden'
  • Error message states 'You cannot publish over the previously published versions'
  • npm publish command fails before uploading package contents
  • Error occurs for both public and scoped packages
  • May appear after initial publish attempt or in CI/CD pipelines

Common causes

  1. Attempting to publish the same version number as an existing published package
  2. In monorepos (Lerna, Yarn Workspaces), a partial publish succeeded before failure
  3. Trying to reuse a version number even after unpublishing (permanently reserved)
  4. Forgot to bump version number after previous successful publish
  5. CI/CD pipeline ran twice without version increment between runs

How to fix "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs.org/package - You cannot publish over the previously published versions"

1Check the current published version

Query the npm registry to see what versions already exist:

bash
npm info your-package-name

Or for scoped packages:

bash
npm info @your-username/package-name

This shows all published versions. Note the highest version number currently published.

2Increment the version number

Update the version field in your package.json to a higher version following semantic versioning:

bash
# For patch release (1.0.0 -> 1.0.1)
npm version patch

# For minor release (1.0.0 -> 1.1.0)
npm version minor

# For major release (1.0.0 -> 2.0.0)
npm version major

The npm version command automatically creates a git commit and tag.

3Verify the new version before publishing

Double-check that your package.json now contains a unique version number:

bash
cat package.json | grep version

Confirm this version does NOT appear in the npm info output from Step 1.

4Publish the new version

Now publish with the incremented version:

bash
npm publish

For scoped packages that should be public:

bash
npm publish --access public
5Verify successful publication

Confirm the new version is available:

bash
npm info your-package-name

You should see your new version in the list of published versions.

Advanced notes

Immutability and Security: npm enforces strict version immutability to prevent supply-chain attacks. Once a version is published, it can never be modified or reused, even if unpublished.

Unpublish Policy: You can unpublish a newly published package within 72 hours only if no other packages depend on it. After 72 hours, unpublishing is not allowed unless the package has zero dependents. Even when unpublished, the version number remains permanently reserved.

24-Hour Waiting Period: If you unpublish an entire package, you cannot publish any new versions of that package until 24 hours have passed.

Deprecation as Alternative: If your package doesn't meet unpublish criteria, use npm deprecate to mark it with a warning message while keeping it available for existing users.

Prerelease Versions: Use prerelease versions during development to avoid locking production version numbers:

json
{ "version": "1.0.0-alpha.1" }

Increment prerelease: npm version prerelease → 1.0.0-alpha.2

Frequently asked questions

What does "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs" mean?
This error occurs when you attempt to publish an npm package with a name and version combination that already exists in the registry. npm enforces version immutability for security and ecosystem stability—once a version is published, it can never be overwritten or reused, even if it's unpublished. This is a deliberate design choice to prevent supply-chain attacks where a malicious actor could replace legitimate code with compromised code while keeping the same version number.
How do I fix "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs"?
This error occurs when you attempt to publish an npm package with a version number that already exists in the registry. npm enforces version immutability for security and ecosystem stability—once a version is published, it can never be overwritten or reused.
What causes "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs"?
Attempting to publish the same version number as an existing published package In monorepos (Lerna, Yarn Workspaces), a partial publish succeeded before failure Trying to reuse a version number even after unpublishing (permanently reserved)
Is the "npm ERR! code E403 npm ERR! 403 Forbidden - PUT https://registry.npmjs" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading