NodeJS Security & NodeJS Secure Coding's Blog

Getting started with the npm audit command and learn why it's not enough and how to advance your project's security posture with more robust security tools like Snyk.

Better some security than none at all.

Have I gone mad?

Briefly exploring core concepts around Node API security with regards to GraphQL and REST API design with code examples specific to Node.js application servers.

Briefly exploring the Node.js threat model to draw some opinions on whether Node.js is secure or not.

Are you using regex to validate URLs?

Learn how I discovered a Node.js core prototype pollution regression, its security implications, and why it didn't warrant a CVE.

A recent security issue in the Deno CLI (CVE-2024-37150) highlights the importance of secure credential handling.

JavaScript developers need security skills to safeguard user data, prevent application breaches, and maintain user trust.

Learn about Prototype Pollution in Node.js: what it is, how it works, and how to prevent it.

Sasha shares how they inadvertently wrote a React Server Component code that would have resulted in a security breach, if not refactored in time to fix the issue.

Interestingly enough, the IDOR vulnerability type is found as a CVE more commonly in some languages rather than others.

The most upvoted Reddit answer to a question about serving images via a route in Express.js is a security vulnerability waiting to happen.

Are we going to settle the debate between raw SQL queries and ORMs once and for all?

Enhance your development workflow with JavaScript security best practices.

Path traversal vulnerabilities were discovered in webpack and backstage npm packages.

Secure JavaScript coding practices are essential to prevent command injection vulnerabilities in Node.js applications.

Can you spot an Insecure Direct Object Reference (IDOR) vulnerability in your JavaScript application?

Learn about recent npm vulnerabilities in popular npm packages and how to protect your applications from security reports disclosed in 2024.

A project fork is not without risks, and this time it's the safe-eval-2 npm package that is vulnerable to code injection attacks.

Learn how to secure your Node.js applications with the new Permissions Model, stay informed about security releases, and understand the Node.js Security Threat.

Learn about common Node.js security issues and how to mitigate them.

The npm ecosystem is a minefield of security risks.

The XZ backdoor CVE-2024-3094 already happened in JavaScript 5 years ago but now the xz and liblzma malware bundled onto Linux distributions is bringing forth a world-wide threatening event in cybersecurity that jeopardizes the trust, sustainability and s…

Level up your Node.js security game!

How do you maintain Node.js secure configuration?

Node.js applications can be vulnerable to issues like command injection, path traversal, and insecure APIs.

Building secure node.js applications starts with applying essential input validation best practices and techniques to prevent common security vulnerabilities.

Don't let vulnerabilities slow you down: Introducing is-my-node-vulnerable, the Node.js vulnerability scanner.

Introducing JavaScript security issues in Node.js applications such as Cross-site Scripting (XSS) and Content Security Policy (CSP).

Properly implementing authentication and authorization is crucial for securing Node.js apps.

Learn how to secure Node.js applications with OWASP's comprehensive best practices guidelines and practical techniques for authentication, authorization, cryptography, input validation, and more.

Insecure direct object references (IDOR) are an important web application security concept that every developer should understand.

North Korean state hackers compromise npm supply chain with malicious packages; crypto thieves exploit Ledger Connect kit library published to npm, stealing $600k before detected; incident highlights risks of uncontrolled open source usage and need for be…

Learn best practices and strategies to identify and prevent command injection vulnerabilities in your JavaScript projects.

Exploring the OWASP Top Ten list, and dissecting how Node.js applications can fall prey to command injection attacks.

How do you identify vulnerable code patterns?

Let's explore a recently disclosed argument injection flaw in the popular 'blamer' npm package that allowed overwriting arbitrary files by exploiting the 'git blame' command.

This article explores real-world command injection vulnerabilities that have impacted popular applications, emphasizing the need for secure coding practices.

Command injection vulnerabilities pose a significant threat to Node.js and JavaScript applications' security.