diff --git a/bbot/modules/retirejs.py b/bbot/modules/retirejs.py
index 78fc72dfed..b82153e856 100644
--- a/bbot/modules/retirejs.py
+++ b/bbot/modules/retirejs.py
@@ -185,7 +185,7 @@ async def handle_event(self, event):
                                 data = {
                                     "name": "Vulnerable JavaScript Library",
                                     "description": description,
-                                    "severity": severity,
+                                    "severity": "INFO",
                                     "confidence": "HIGH",
                                     "component": component,
                                     "url": event.parent.url,
diff --git a/bbot/test/test_step_2/module_tests/test_module_retirejs.py b/bbot/test/test_step_2/module_tests/test_module_retirejs.py
index 07c1fb462b..83ed5f7827 100644
--- a/bbot/test/test_step_2/module_tests/test_module_retirejs.py
+++ b/bbot/test/test_step_2/module_tests/test_module_retirejs.py
@@ -136,6 +136,10 @@ def has_vuln(library, version, cve, js_url):
             # url field should point to the page that loaded the JS, not the JS file itself
             assert finding.data["url"] == "http://127.0.0.1:8888/", "url should be the parent page URL"
             assert finding.parent.type == "URL_UNVERIFIED", "Parent should be URL_UNVERIFIED"
+            # severity should always be INFO; the CVE severity belongs in the description only
+            assert finding.data["severity"] == "INFO", (
+                f"Finding severity should be INFO, got {finding.data['severity']}"
+            )
 
 
 class TestRetireJSNoExcavate(ModuleTestBase):