Advanced Web, API & Modern Stack

Node.js & Express Security

Server-side JS bugs: injection, SSRF, path traversal, and supply chain.

Advanced · 16 min

Open the interactive lesson →

Node.js puts JavaScript on the server, with full access to the filesystem, processes, and network. That power creates classic bugs with Node-specific sinks — essential knowledge for anyone testing (or building) a MERN/Express stack.

Node-specific sinks to hunt

• Command injection — child_process.exec(`cmd ${input}`); use execFile with an args array instead.
• Path traversal — fs.readFile(userPath) without normalisation → arbitrary file read.
• SSRF — server-side fetch/axios to a user-supplied URL.
• Code injection — eval(), the Function constructor, or unsafe template rendering.
• Prototype pollution — unsafe deep-merge of request bodies (see its lab).
• ReDoS — a catastrophic regex on user input freezes the single event-loop thread.

// BAD — shell injection
exec(`ping -c1 ${req.query.host}`);
// GOOD — no shell, args as data
execFile('ping', ['-c1', req.query.host]);

Supply chain (npm)

• Malicious/typosquatted packages and compromised maintainers.
• Vulnerable transitive deps — audit with npm audit / Snyk / Socket.
• Secrets leaked in package scripts or committed .env files.

Take the quiz →