Curated security research, vulnerabilities, advisories and tools for practitioners.

#nodejs

Security coverage tagged nodejs.

1.

Critical remote code execution in vm2, a widely used Node.js sandbox library

vulnerability | 2026-09-02 00:00 | about.gitlab.com | original ↗ | #rce | #gitlab | #sandbox-escape

2.

Dojo challenge #51 Deadbolt solution

blog | 2026-06-10 07:54 | yeswehack.com | original ↗ | #rce | #ctf | #dojo

3.

npm v12 delivers one of the biggest security improvements in years

blog | 2026-06-11 00:00 | aikido.dev | original ↗ | #supply-chain | #devsecops | #open-source

4.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

vulnerability | Medium | 2026-04-14 00:00 | CVE-2026-40175 | aikido.dev | original ↗ | #prototype-pollution | #request-smuggling | #cve

5.

React2Shell (CVE-2025-55182): Node.js RCE Against a Production Next.js App

vulnerability | Critical | Actively exploited | 2025-12-10 00:00 | CVE-2025-55182 | hunt.io | original ↗ | #rce | #vulnerability | #nextjs

6.

Top 10 JavaScript Security Vulnerabilities in Modern Web Apps

blog | 2025-11-04 00:00 | CVE-2020-11023 | aikido.dev | original ↗ | #npm | #xss | #vulnerabilities

7.

NPM Security Audit: The Missing Layer Your Team Still Need

blog | 2025-08-13 00:00 | aikido.dev | original ↗ | #supply-chain | #npm | #audit

8.

Sensing and blocking JavaScript SQL injection attacks

blog | 2025-03-04 00:00 | aikido.dev | original ↗ | #sql-injection | #web-security | #waf

9.

Leveraging JSDoc for Better Code Documentation in JavaScript

blog | 2024-04-05 01:01 | hackerone.com | original ↗ | #documentation | #javascript | #developer-tools

10.

NestJS vs Express: A Comparative Analysis for Secure and Efficient Web Development

blog | 2024-02-07 03:05 | hackerone.com | original ↗ | #appsec | #typescript | #nodejs

11.

Why is NPM Fetching a Dependency Not in My package-lock.json?

blog | 2024-01-25 06:59 | hackerone.com | original ↗ | #supply-chain | #npm | #package-management

12.

Preventing prototype pollution in your repository

blog | 2023-06-01 00:00 | aikido.dev | original ↗ | #cloud | #rce | #remediation

13.

Server-side prototype pollution: Black-box detection without the DoS

research | 2023-03-28 09:50 | portswigger.net | original ↗ | #web-security | #prototype-pollution | #detection

14.

Exploiting prototype pollution in Node without the filesystem

research | 2023-03-23 15:00 | portswigger.net | original ↗ | #rce | #web-security | #prototype-pollution

15.

Server side prototype pollution, how to detect and exploit

vulnerability | 2023-02-15 16:19 | yeswehack.com | original ↗ | #bug-bounty | #vulnerability-research | #web-security

16.

Decompiling Node.js in Ghidra

research | 2021-05-20 15:18 | swarm.ptsecurity.com | original ↗ | #reverse-engineering | #ghidra | #research

17.

How we bypassed bytenode and decompiled Node.js bytecode in Ghidra

research | 2021-05-13 16:03 | swarm.ptsecurity.com | original ↗ | #reverse-engineering | #ghidra | #v8

18.

Node.js + Express Tutorial for 2021

blog | 2021-04-07 01:00 | hackerone.com | original ↗ | #cloud | #tutorial | #javascript

19.

KeystoneJS & GraphQL API Crash Course

blog | 2021-03-23 01:00 | hackerone.com | original ↗ | #cloud | #graphql | #tutorial

20.

How to Use TypeScript in a Node.js and Express Project

blog | 2021-01-06 00:00 | hackerone.com | original ↗ | #cloud | #tutorial | #typescript

21.

Code Reviewer Spotlight: Eli Perelman

blog | 2019-01-08 06:05 | hackerone.com | original ↗ | #open-source | #code-review | #interview

22.

Open Source: It’s turtles all the way down.

blog | 2018-11-27 00:00 | bugcrowd.com | original ↗ | #cloud | #supply-chain | #open-source

23.

HackerOne CEO joins Node.js Foundation Board

vulnerability | 2017-11-06 16:00 | hackerone.com | original ↗ | #bug-bounty | #open-source | #cve

24.

HackerOne Joins Forces with Node.js Foundation to Build a Safer Internet

vulnerability | 2017-10-04 17:00 | hackerone.com | original ↗ | #bug-bounty | #open-source | #community