nodejs
Safeguard articles tagged "nodejs" — guides, analysis, and best practices for software supply chain and application security.
112 articles
Building a secure GraphQL API with Node.js
A practical guide to securing Node.js GraphQL APIs: query complexity limits, field-level authorization, injection-safe resolvers, and CSRF hardening.
simple-git: Command Injection CVEs and Safe Usage Patterns
The npm simple-git library went through a chain of argument injection CVEs in 2022, each an incomplete fix of the last. The history is a case study in why wrapping a CLI safely is hard.
cross-fetch: Package Health and Security Review
cross-fetch still ships in thousands of lockfiles as a universal fetch polyfill. A review of its one CVE, its node-fetch dependency, and when you no longer need it.
npm bluebird in 2025: Is the Promise Library Still Safe to Use?
The npm bluebird package still gets tens of millions of weekly downloads, but it has gone quiet. Here is an honest read on whether to keep it or migrate.
node-html-parser: How to Parse HTML Safely in Node.js
node-html-parser is a fast, dependency-light HTML parser for Node.js. Here is how to use it without opening the door to injection or denial-of-service bugs.
Is the npm qs Package Safe? A Security Review of qs
The npm qs package parses query strings under most Express apps, and a prototype pollution flaw once let a single URL hang your Node process. Here is what to check and how to use qs safely.
How to Run JavaScript Code: Methods and Security Notes
A practical guide to how to run JavaScript code in the browser, with Node.js, and from the command line, plus the security traps that turn a convenient runner into a liability.
jsonwebtoken npm: Security Review and Safe Usage
The jsonwebtoken npm package signs and verifies JWTs for countless Node apps, and versions at or below 8.5.1 carry serious verification flaws. Here is how to use npm jsonwebtoken safely.
aws-sdk-mock: Secure Testing and Migration to SDK v3
aws-sdk-mock targets AWS SDK v2, which is now in maintenance mode. Here is how it works, where the security risk lives, and how to migrate to aws-sdk-client-mock for v3.
Is npm body-parser Safe? A Security Review and Safe-Usage Guide
A practical look at npm body-parser, the CVE-2024-45590 denial-of-service issue, and how to configure the middleware so it does not become a liability in production.
What Is a Node.js Backend? A Security Guide for Server-Side JavaScript
A practical look at building a Node.js backend that holds up in production, from dependency risk to input validation, with real config you can copy.
How to Update Node.js Safely: A Security-First Guide
The safest way to update Node.js is to move to a supported LTS line and treat the upgrade as a security event, not a chore. Here is a practical path from an EOL version to a maintained one.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.