javascript-security
Safeguard articles tagged "javascript-security" — guides, analysis, and best practices for software supply chain and application security.
45 articles
CVE-2019-10768: The AngularJS Prototype Pollution Flaw Explained
CVE-2019-10768 is a prototype pollution vulnerability in AngularJS before 1.7.9, where the merge() function can be tricked into modifying Object.prototype. Here is what it does, who it affects, and how to remediate.
Is uglifyjs-webpack-plugin Safe to Use in 2025? What to Migrate To
uglifyjs-webpack-plugin is deprecated and built on the unmaintained uglify-es. Here is why you should migrate to terser-webpack-plugin and how to do it cleanly.
uuid npm: Security Review and Safe Usage Guide
The uuid npm package is one of the most-installed libraries in the JavaScript ecosystem. Here is an honest look at its security posture and how to use it correctly.
What Is react-server-dom-webpack? A Security Guide
react-server-dom-webpack is the low-level React Server Components binding meta-frameworks build on. Here is what it does and where the security risks actually live.
CVE-2022-25844: The AngularJS ReDoS Bug and How to Fix It
CVE-2022-25844 is a regular-expression denial-of-service flaw in AngularJS. Here is what it affects, why there is no upstream patch, and how to remediate it.
jQuery 3.7.1 Vulnerabilities: What Actually Changed From Earlier Releases
jQuery 3.7.1 vulnerabilities are mostly inherited history, not new CVEs — the real security story is what changed across 3.4, 3.5, and 3.7.
CVE-2023-45133: Babel's Arbitrary Code Execution Flaw Explained
CVE-2023-45133 lets crafted code execute arbitrary commands during Babel compilation. Here's who is at risk, why it scores 9.3, and how to patch it.
CVE-2023-45857: The Axios XSRF Token Leak Explained
How CVE-2023-45857 caused Axios to leak XSRF tokens to any host over cross-origin requests, who is affected, and the one-line upgrade that fixes it.
What is Prototype Pollution
Prototype pollution lets attackers corrupt Object.prototype via unsafe merges, turning a data bug in lodash, jQuery, or minimist into RCE.
npm handlebars: A Security Review and Safe Usage Guide
The npm handlebars package is a widely used templating engine with a history of prototype pollution issues. Here is what to know before you depend on it and how to use it safely.
Lodash 4.17.21: The Security History Behind the Version Bump
Lodash 4.17.21 closed a ReDoS path in its number-parsing helpers and a command-injection risk in its templating function — here's the security history that led up to it.
npm underscore Security Review: Is It Safe to Use in 2025?
A security review of the npm underscore package, the code-injection CVE in its template function, and whether you still need it in a modern JavaScript stack.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.