Curated security research, vulnerabilities, advisories and tools for practitioners.

#nodejs

Security coverage tagged nodejs.

1.

GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)

advisory | Critical | 2026-10-22 15:32 | CVE-2026-111497 | github.com | Original ↗ | .md | #rce | #supply-chain | #nodejs

2.

simple-git Command Injection to Remote Code Execution PoC (CVE-2026-6951)

vulnerability | High | 2026-09-28 08:48 | CVE-2026-6951 | github.com | Original ↗ | .md | #rce | #supply-chain | #poc

3.

Aikido funds Node.js security

blog | 2026-09-28 00:00 | aikido.dev | Original ↗ | .md | #bug-bounty | #aikido | #open-source-security

4.

Critical remote code execution in vm2, a widely used Node.js sandbox library

vulnerability | 2026-09-02 00:00 | about.gitlab.com | Original ↗ | .md | #rce | #gitlab | #sandbox-escape

5.

Dojo challenge #51 Deadbolt solution

blog | 2026-06-10 07:54 | yeswehack.com | Original ↗ | .md | #rce | #ctf | #dojo

6.

npm v12 delivers one of the biggest security improvements in years

blog | 2026-06-11 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #devsecops | #open-source

7.

Axios CVE-2026-40175: a critical bug that’s… not exploitable

vulnerability | Medium | 2026-04-14 00:00 | CVE-2026-40175 | aikido.dev | Original ↗ | .md | #prototype-pollution | #request-smuggling | #cve

8.

Total.js RCE gadgets all around

research | 2026-02-23 00:00 | lab.ctbb.show | Original ↗ | .md | #rce | #exploitation | #gadget-chain

9.

React2Shell (CVE-2025-55182): Node.js RCE Against a Production Next.js App

vulnerability | Critical | Actively exploited | 2025-12-10 00:00 | CVE-2025-55182 | hunt.io | Original ↗ | .md | #rce | #vulnerability | #nextjs

10.

Top 10 JavaScript Security Vulnerabilities in Modern Web Apps

blog | 2025-11-04 00:00 | CVE-2020-11023 | aikido.dev | Original ↗ | .md | #npm | #xss | #vulnerabilities

11.

NPM Security Audit: The Missing Layer Your Team Still Need

blog | 2025-08-13 00:00 | aikido.dev | Original ↗ | .md | #supply-chain | #npm | #audit

12.

Sensing and blocking JavaScript SQL injection attacks

blog | 2025-03-04 00:00 | aikido.dev | Original ↗ | .md | #sql-injection | #web-security | #waf

13.

Leveraging JSDoc for Better Code Documentation in JavaScript

blog | 2024-04-05 01:01 | hackerone.com | Original ↗ | .md | #documentation | #javascript | #developer-tools

14.

NestJS vs Express: A Comparative Analysis for Secure and Efficient Web Development

blog | 2024-02-07 03:05 | hackerone.com | Original ↗ | .md | #appsec | #typescript | #nodejs

15.

Why is NPM Fetching a Dependency Not in My package-lock.json?

blog | 2024-01-25 06:59 | hackerone.com | Original ↗ | .md | #supply-chain | #npm | #package-management

16.

Preventing prototype pollution in your repository

blog | 2023-06-01 00:00 | aikido.dev | Original ↗ | .md | #cloud | #rce | #remediation

17.

Server-side prototype pollution: Black-box detection without the DoS

research | 2023-03-28 09:50 | portswigger.net | Original ↗ | .md | #web-security | #prototype-pollution | #detection

18.

Exploiting prototype pollution in Node without the filesystem

research | 2023-03-23 15:00 | portswigger.net | Original ↗ | .md | #rce | #web-security | #prototype-pollution

19.

Server side prototype pollution, how to detect and exploit

vulnerability | 2023-02-15 16:19 | yeswehack.com | Original ↗ | .md | #bug-bounty | #vulnerability-research | #web-security

20.

Decompiling Node.js in Ghidra

research | 2021-05-20 15:18 | swarm.ptsecurity.com | Original ↗ | .md | #reverse-engineering | #ghidra | #research

21.

How we bypassed bytenode and decompiled Node.js bytecode in Ghidra

research | 2021-05-13 16:03 | swarm.ptsecurity.com | Original ↗ | .md | #reverse-engineering | #ghidra | #v8

22.

Node.js + Express Tutorial for 2021

blog | 2021-04-07 01:00 | hackerone.com | Original ↗ | .md | #cloud | #tutorial | #javascript

23.

KeystoneJS & GraphQL API Crash Course

blog | 2021-03-23 01:00 | hackerone.com | Original ↗ | .md | #cloud | #graphql | #tutorial

24.

How to Use TypeScript in a Node.js and Express Project

blog | 2021-01-06 00:00 | hackerone.com | Original ↗ | .md | #cloud | #tutorial | #typescript

25.

Code Reviewer Spotlight: Eli Perelman

blog | 2019-01-08 06:05 | hackerone.com | Original ↗ | .md | #open-source | #code-review | #interview

26.

Open Source: It’s turtles all the way down.

blog | 2018-11-27 00:00 | bugcrowd.com | Original ↗ | .md | #cloud | #supply-chain | #open-source

27.

Escape NodeJS Sandboxes

blog | 2018-11-27 00:00 | netspi.com | Original ↗ | .md | #sandbox-escape | #reverse-shell | #javascript

28.

HackerOne CEO joins Node.js Foundation Board

vulnerability | 2017-11-06 16:00 | hackerone.com | Original ↗ | .md | #bug-bounty | #open-source | #cve

29.

HackerOne Joins Forces with Node.js Foundation to Build a Safer Internet

vulnerability | 2017-10-04 17:00 | hackerone.com | Original ↗ | .md | #bug-bounty | #open-source | #community