| name | code-review-nodejs |
| description | Security review of Node.js / JavaScript code — dangerous sinks and Express/framework pitfalls. Load when reviewing a Node/JS codebase/PR, on package.json + Express/Next/Nest, or "review this Node app". Signals: child_process, eval, Function, prototype pollution, JWT, Mongoose/Sequelize.
|
| domain | code-review |
| type | reference |
| stability | learning |
| modes | ["bugbounty","defense","pentest"] |
| severity | info |
| cwe | ["CWE-94","CWE-78","CWE-1321","CWE-89"] |
| tools | ["semgrep","njsscan","ripgrep"] |
| schema_version | 1 |
Node.js / JavaScript security code review
When it applies
Reading Node/JS source (Express, Next.js, NestJS, a package). Language companion to
code-review-methodology — the exact sinks and framework gotchas to grep and trace.
Sinks & patterns (grep, then trace to user input)
- Command exec:
child_process.exec/execSync with user input (use execFile/spawn w/ arg array);
template strings in commands.
- Code eval:
eval, new Function, vm.runIn…, setTimeout("string") — RCE.
- Prototype pollution: recursive merge/
Object.assign/lodash.merge/set, JSON.parse into
object merges, query parsers — __proto__/constructor keys (→ web-prototype-pollution).
- SQL/NoSQL: string-built SQL; Mongo queries taking raw
req.body/req.query (operator injection
{$gt:''}); Sequelize .query()/literal.
- SSRF:
axios/fetch/http.get/request on a user URL.
- Path/upload:
fs.readFile/sendFile/path.join with user paths; res.sendFile traversal.
- XSS (server + client):
res.send of unescaped input; DOM sinks innerHTML, document.write,
dangerouslySetInnerHTML (React), v-html (Vue).
- Deserialization:
node-serialize/funcster (unserialize RCE), untrusted JSON→object merge.
Framework specifics
- Express: missing
helmet/CSP, over-broad cors(), req.query/req.params into sinks, weak
session secret, no per-object authz (IDOR/BOLA), order bypassing auth middleware.
