nodejs-security
Safeguard articles tagged "nodejs-security" — guides, analysis, and best practices for software supply chain and application security.
44 articles
How to Use bcryptjs from npm Safely: A Security Review
The bcryptjs npm package is a pure-JavaScript bcrypt implementation with zero native dependencies. Here is when to reach for it, how to use it correctly, and the pitfalls that weaken password hashing.
Preventing broken access control in Express.js applications
Express.js ships with no built-in authorization layer, making broken access control easy to introduce and hard to catch with pattern-based scanners.
Security concerns of using the Node.js VM module as a sandbox
Node's vm module and vm2 were never a security boundary. Four critical CVEs and a 2023 deprecation prove why untrusted-code sandboxes need real isolation.
Is the npm express Package Safe? A Security Review
The npm express package is the most widely used Node.js web framework, and it is safe to run today if you stay on a maintained version and watch its small dependencies. Here is the security picture.
Nodemailer npm: A Security Review and Safe Usage Guide
Nodemailer is the default way to send email from Node.js. It is well maintained, but email is a classic injection surface. Here is a security review and how to use it safely.
Buffer Streams: Handling Binary Data Safely in Node.js
Buffer streams are how Node.js moves binary data without loading it all into memory. Here is how they work and the security bugs that hide in buffer handling.
Node.js Security Best Practices
Node.js supply chain attacks like event-stream, ua-parser-js, and Shai-Hulud show why dependency depth is the real risk -- here's what actually reduces it.
npm supply chain attacks via malicious postinstall scripts
How a single postinstall hook in a compromised npm package can run malware at install time, real incidents from 2018-2025, and how to defend against it.
NestJS dependency injection and module configuration secu...
NestJS's dependency injection container silently governs data isolation and supply-chain trust. Here's how scope, module, and factory misconfigurations turn into real security failures.
Prototype pollution vulnerabilities in Node.js and NestJS...
How prototype pollution reaches NestJS apps through lodash, qs, tough-cookie, and dotenv-expand — and how Safeguard catches it before it merges.
systeminformation npm package command injection (CVE-2021-21315)
A critical command injection flaw in the systeminformation npm package (CVE-2021-21315) let attackers run OS commands via unsanitized shell calls. Here's the full breakdown.
Express qs library prototype pollution DoS (CVE-2022-24999)
CVE-2022-24999 lets attackers pollute Object.prototype through qs, the query-string parser Express relies on, crashing Node.js applications.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.