nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
JavaScript DI: Dependency Injection Patterns and Their Security Impact
JavaScript DI (dependency injection) decouples your code, but the container that wires it together is also a place security can slip. Here is how to use it well.
Running Node.js on Ubuntu in Docker, Securely
A guide to the Node Ubuntu Docker pattern: when an Ubuntu base makes sense for Node.js, how to build it safely, and the security trade-offs versus slim images.
npm ws Security: Fixing the CVE-2024-37890 WebSocket DoS
The npm ws package powers most Node WebSocket servers. CVE-2024-37890 let a flood of request headers crash it. Here is how the flaw works and how to patch.
Multer on npm: Security Review and the 2025 DoS Fixes
Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.
form-data npm Package: Usage, Health, and Security Review
The form-data npm package builds multipart request bodies for half the Node.js ecosystem — and its 2025 predictable-boundary CVE showed how a one-line randomness choice becomes an injection primitive.
Node.js Security News: Recent Advisories and How to Stay Ahead
Node.js security news moves on a predictable cadence. Here is how to read the advisories, act on the ones that matter, and harden your apps.
Is Node.js Safe? A Security Guide for Production Apps
Is Node.js safe to run in production? The runtime itself is well maintained and secure by modern standards. The real risk lives in the dependency tree and how you configure the app around it.
webpack-dev-middleware Security: The CVE-2024-29180 Path Traversal Fix
webpack-dev-middleware serves your bundle in development, but CVE-2024-29180 let a crafted URL read any file off a developer's machine. Here is the fix.
Archiver npm: A Security Review and Safe-Usage Guide
The archiver npm package builds zip and tar streams cleanly, but the real risks are on the extraction side and in its dependency tree. Here is how to use it safely.
jwks-rsa: Verifying JWTs Against a JWKS Endpoint Safely
The jwks-rsa npm library fetches signing keys from a JWKS endpoint so you can verify JWTs correctly. Here is how to wire it up without introducing key-confusion or availability bugs.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
Dependency Injection in JS: A Practical Security Guide
Dependency injection in JS improves testability, but it also becomes an attack surface when injection is dynamic or unvalidated. Here is how to keep it safe.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.