nodejs-security
Safeguard articles tagged "nodejs-security" — guides, analysis, and best practices for software supply chain and application security.
44 articles
CVE-2023-32314: Sandbox escape in vm2
CVE-2023-32314 let attackers escape the vm2 Node.js sandbox for remote code execution. Here's the CVSS 10.0 flaw, affected versions, timeline, and fixes.
CVE-2023-37466: Remote code execution via vm2 sandbox escape
A critical vm2 sandbox escape (CVE-2023-37466) lets untrusted JavaScript break out to achieve remote code execution on the host Node.js process.
CVE-2021-43138: Code injection risk in async npm package
A prototype-pollution flaw in async's iterator functions (CVE-2021-43138) could escalate to code injection. Affected versions, severity, timeline, and remediation steps inside.
Is the exceljs npm Package Safe? A Security Review
The exceljs npm package is a maintained, popular library for reading and writing Excel files, and it is a reasonable choice, but parsing untrusted spreadsheets carries real risk. Here is the review.
JavaScript Exploits Explained: How They Work and How to Stop Them
JavaScript exploits target the code that runs in browsers and on Node servers. Here is how the main attack classes work and the defenses that actually hold up.
Is Node.js Safe? A Security Guide
Node.js itself is safe when kept current and configured well. Most real risk lives in your dependencies and your code, not the runtime.
How to prevent log injection vulnerabilities in Node.js
Log injection lets attackers forge log entries in Node.js apps via unsanitized input. Learn the sanitization, encoding, and structured-logging fixes that stop it.
Node.js vm Module Security: Why It Is Not a Sandbox
The Node.js vm module runs code in a separate V8 context, but it is not a security sandbox. Here is why untrusted code can escape it and what to use instead.
Comparing Node.js frameworks for security: Express, Fastify, NestJS
Express, Fastify, and NestJS compared on real CVE history, default security posture, and dependency risk — plus how to close the gaps framework choice alone can't.
5 Node.js security code snippets every backend developer should know
Five real Node.js vulnerability patterns with vulnerable-vs-fixed code: prototype pollution, NoSQL injection, missing headers, path traversal, and JWT flaws.
Vitest on npm: A Security Review Before You Add It
Vitest is a fast Vite-native test runner, but its API and browser-mode servers have a real security footprint. Here is what to check before adding vitest from npm.
yup npm: A Security Review of the Schema Validation Library
The yup npm package is a mature, actively maintained schema validation library, and it is safe to use, but validation belongs on the server and yup schemas need to be written defensively. Here is the review.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.