code-review-nodejs

name	code-review-nodejs
description	Security review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
domain	code-review
type	reference
stability	learning
modes	["bugbounty","defense","pentest"]
severity	info
cwe	["CWE-94","CWE-78","CWE-1321","CWE-89"]
tools	["semgrep","njsscan","ripgrep"]
schema_version	1

Node.js / JavaScript security code review

When it applies

Reading Node/JS source (Express, Next.js, NestJS, a package). Language companion to code-review-methodology — the exact sinks and framework gotchas to grep and trace.

Sinks & patterns (grep, then trace to user input)

• Command exec: child_process.exec/execSync with user input (use execFile/spawn w/ arg array); template strings in commands.
• Code eval: eval, new Function, vm.runIn…, setTimeout("string") — RCE.
• Prototype pollution: recursive merge/Object.assign/lodash.merge/set, JSON.parse into object merges, query parsers — __proto__/constructor keys (→ web-prototype-pollution).
• SQL/NoSQL: string-built SQL; Mongo queries taking raw req.body/req.query (operator injection {$gt:''}); Sequelize .query()/literal.
• SSRF: axios/fetch/http.get/request on a user URL.
• Path/upload: fs.readFile/sendFile/path.join with user paths; res.sendFile traversal.
• XSS (server + client): res.send of unescaped input; DOM sinks innerHTML, document.write, dangerouslySetInnerHTML (React), v-html (Vue).
• Deserialization: node-serialize/funcster (unserialize RCE), untrusted JSON→object merge.

Framework specifics

• Express: missing helmet/CSP, over-broad cors(), req.query/req.params into sinks, weak session secret, no per-object authz (IDOR/BOLA), order bypassing auth middleware.