I create an empty NodeJS project very minimal to investigate high vulnerability message i get when I run npm i to build dependencies.

here is the basic package.json.

{
  "name": "test",
  "version": "1.0.0",
  "main": "test.js",
  "type": "module",
  "scripts": {
    "test": "echo "Error: no test specified" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.18.2"
  },
  "description": ""
}

When i run npm i on this project, i get following message:

up to date, audited 65 packages in 532ms

12 packages are looking for funding
run npm fund for details

2 high severity vulnerabilities*

To address all issues (including breaking changes), run:
npm audit fix –force

Run npm audit for details.

Obviously, i run npm audit fix –force and it can’t fix it, it tries to downgrade Express to 3.21 but bring even more vulnerabilities.

Info: i have been working with NodeJS and Express for the last year and i have other NodeJS projects working fine with Express 4.18.2.

Any idea why it is now broken and npm not able to build with Express 4.18.2. I tried 4.19.2 and I am getting same issue.

Any feedback appreciated.

tried

npm audit fix --force 

as suggested but 2 high vulnerability thrown.