DevFixProDev Toolkit
Home / Lists / DevFix Hub / 15 Open-Source Web App & Frontend Security Tools (GitHub Stars 2026)

15 Open-Source Web App & Frontend Security Tools (GitHub Stars 2026)

The most-starred open-source libraries for hardening web and frontend apps - XSS sanitization, auth, validation, CORS and rate limiting.

By The DevFixPro Editorial Team · independent editorial research project

Star counts retrieved from the GitHub API on 2026-08-17. Open-source projects grow daily, so treat the numbers as a snapshot — always check the linked repository for the latest figures, license, and activity.

App-layer security is mostly libraries you wire in correctly. This list ranks 15 of the most popular open-source web app and frontend security tools by GitHub stars (fetched 2026-08-17) - XSS sanitizers, auth middleware, schema validators, CORS and rate limiting.

  1. 1DOMPurify on GitHub
    DOMPurify★ 17,309
    By Cure53

    Sanitize untrusted HTML to prevent XSS in the browser.

    View on GitHub →
  2. 2OWASP CheatSheetSeries on GitHub
    OWASP CheatSheetSeries★ 32,909
    By OWASP

    Collection of high-value security cheat sheets for developers.

    View on GitHub →
  3. 3jsonwebtoken on GitHub
    jsonwebtoken★ 18,190
    By Auth0

    Sign and verify JSON Web Tokens in Node.js.

    View on GitHub →
  4. 4validator.js on GitHub
    validator.js★ 23,739
    By Validator.js

    String validation and sanitization library for JS.

    View on GitHub →
  5. 5Helmet on GitHub
    Helmet★ 10,718
    By Helmet.js

    Set secure HTTP headers to harden Express apps.

    View on GitHub →
  6. 6js-xss on GitHub
    js-xss★ 5,314
    By Zongmin Lei

    Filter user input to block XSS attacks in Node/browser.

    View on GitHub →
  7. 7sanitize-html on GitHub
    sanitize-html★ 4,120
    By ApostropheCMS

    Allow-list HTML sanitizer for Node.js server-side cleaning.

    View on GitHub →
  8. 8Retire.js on GitHub
    Retire.js★ 4,159
    By RetireJS

    Detect JavaScript libraries with known vulnerabilities in the browser.

    View on GitHub →
  9. 9Passport on GitHub
    Passport★ 23,528
    By Jared Hanson

    Simple, unobtrusive authentication middleware for Node.js.

    View on GitHub →
  10. 10Snyk CLI on GitHub
    Snyk CLI★ 5,641
    By Snyk

    Find and fix vulnerabilities in dependencies and container images.

    View on GitHub →
  11. 11bcrypt.js on GitHub
    bcrypt.js★ 3,795
    By DC

    Hash passwords with bcrypt in JavaScript.

    View on GitHub →
  12. 12node-argon2 on GitHub
    node-argon2★ 2,178
    By Ranis Alt

    Bindings for the Argon2 hashing algorithm in Node.js.

    View on GitHub →
  13. 13CORS on GitHub
    CORS★ 6,189
    By Express.js

    Enable configurable Cross-Origin Resource Sharing for Express.

    View on GitHub →
  14. 14express-rate-limit on GitHub
    express-rate-limit★ 3,284
    By express-rate-limit

    Limit repeated requests to protect against brute-force and abuse.

    View on GitHub →
  15. 15Zod on GitHub
    Zod★ 43,473
    By Colin McDonnell

    TypeScript-first schema validation to validate untrusted input safely.

    View on GitHub →

← Back to DevFix Hub