diff --git a/packages/server/.nsprc b/packages/server/.nsprc
index 30f62baae0d3bef0fa96b4ebb40957d669e7edc4..f503544dd768b59d02223f8cd7da21a94cb7987b 100644
--- a/packages/server/.nsprc
+++ b/packages/server/.nsprc
@@ -1,3 +1,3 @@
 {
-  "exceptions": ["https://nodesecurity.io/advisories/534"]
+  "exceptions": ["https://nodesecurity.io/advisories/534", "https://nodesecurity.io/advisories/532"]
 }
diff --git a/packages/server/package.json b/packages/server/package.json
index 613caac9ed4e3d8f35cddaa601797fa9445bfcaa..e61386c84cd11b0bce22513b2ebbd17d1b5c6027 100644
--- a/packages/server/package.json
+++ b/packages/server/package.json
@@ -46,6 +46,7 @@
     "prompt": "^1.0.0",
     "pubsweet-sse": "^0.1.4",
     "relational-pouch": "^1.4.5",
+    "require-relative": "^0.8.7",
     "uuid": "^3.0.1",
     "winston": "^2.2.0"
   },
diff --git a/packages/server/src/register-components.js b/packages/server/src/register-components.js
index f10f43cc60786f18e9c26dec35ffe8daaa33f03a..e1bf5090adddb4c9ce8986756a079caf0cf167a4 100644
--- a/packages/server/src/register-components.js
+++ b/packages/server/src/register-components.js
@@ -1,10 +1,11 @@
 const logger = require('@pubsweet/logger')
 const config = require('config')
+const requireRelative = require('require-relative')
 
 module.exports = app => {
   if (config.has('pubsweet.components')) {
     config.get('pubsweet.components').forEach(name => {
-      const component = require(name)
+      const component = requireRelative(name)
       logger.info('Registered component', name)
       const backendComponent = component.server || component.backend
       if (backendComponent) {