corpus.blog
41554 blogs · [ { "id": "01a087b1-0f46-723a-8f96-52fc57febdfa", "title": "Hardening Your npm and pnpm Configs in the Age of Shai-Hulud", "url": "https://www.nodejs-security.com/blog/hardening-your-npm-pnpm-config-for-shai-hulud/", "published_at": "2026-05-30T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc58d4fa74", "title": "Argument Injection vulnerability in git-blame@1.4.0", "url": "https://www.nodejs-security.com/blog/argument-injection-vulnerability-in-git-blame-1-4-0/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5931650e", "title": "Argument Injection vulnerability in `gits@0.1.8`", "url": "https://www.nodejs-security.com/blog/argument-injection-vulnerability-in-gits-0-1-8/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc59c492b6", "title": "Command Injection vulnerability in `@fab1o/git@1.4.0`", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-in-fab1o-git-1-4-0/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5ac411e8", "title": "Command Injection vulnerability in `git-contributors` via unsanitized CLI arguments", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-in-git-contributors-via-unsanitized-cli-arguments/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5ac5f1e6", "title": "Command Injection vulnerability in `git-q@0.0.3`", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-in-git-q/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5b4bf4ee", "title": "Command injection vulnerability via unsanitized CLI arguments in touxing/fast-git-clone", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-via-unsanitized-cli-arguments-in-touxing-fast-git-clone/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5b7e7c23", "title": "Command Injection vulnerability in `willitmerge@0.2.1`", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-willitmerge-0-2-1/", "published_at": "2025-11-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5c76a295", "title": "A Directory Traversal Vulnerability I found in Mastra AI Frameworks MCP Server", "url": "https://www.nodejs-security.com/blog/directory-traversal-vulnerability-in-mastra-ai-frameworks-mcp-server/", "published_at": "2025-09-29T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5d10b6d6", "title": "Mastering NPX: A Cheatsheet for npm and Node.js Power Users", "url": "https://www.nodejs-security.com/blog/mastering-npx-cheatsheet-npm-nodejs-power-users/", "published_at": "2025-09-25T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5d3c5ed8", "title": "Mitigate Supply Chain Security with DevContainers and 1Password for Node.js Local Development", "url": "https://www.nodejs-security.com/blog/mitigate-supply-chain-security-with-devcontainers-and-1password-for-nodejs-local-development/", "published_at": "2025-09-22T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5e0dd4fb", "title": "The Tale of the Vulnerable MCP Database Server", "url": "https://www.nodejs-security.com/blog/the-tale-of-the-vulnerable-mcp-database-server/", "published_at": "2025-09-21T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5e23edf3", "title": "Bad Security Defaults in Mastra AI Frameworks Templates", "url": "https://www.nodejs-security.com/blog/bad-security-defaults-in-mastra-ai-frameworks-templates/", "published_at": "2025-09-18T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5e9e97d7", "title": "SQL Injection and Bypassing \"Read-Only\" Mode in Xata's MCP Server", "url": "https://www.nodejs-security.com/blog/sql-injection-and-bypassing-read-only-mode-in-xata-mcp-server/", "published_at": "2025-09-13T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5f305688", "title": "Security Advisory for qix npm supply-chain compromise affecting debug and billions of weekly download users", "url": "https://www.nodejs-security.com/blog/security-advisory-for-qix-npm-supply-chain-compromise/", "published_at": "2025-09-09T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc5ffab360", "title": "How to Mitigate SQL Bypass in MCP Servers", "url": "https://www.nodejs-security.com/blog/how-to-mitigate-sql-bypass-in-mcp-servers/", "published_at": "2025-09-07T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc6059b4c1", "title": "Enhancing MCP Server Security: A Guide to Using execFile", "url": "https://www.nodejs-security.com/blog/enhancing-mcp-server-security-a-guide-to-using-execfile/", "published_at": "2025-09-05T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc60da23ff", "title": "Argument Injection Vulnerability in ggit", "url": "https://www.nodejs-security.com/blog/argument-injection-vulnerability-in-ggit/", "published_at": "2025-09-04T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc6184da70", "title": "How to Bypass Access Control in PostgreSQL in Simple PSQL MCP Server for SQL Injection", "url": "https://www.nodejs-security.com/blog/how-to-bypass-access-control-in-postgresql-in-simple-psql-mcp-server-for-sql-injection/", "published_at": "2025-08-18T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc61ee5cc0", "title": "Command Injection Flaws in ggit: Unveiling a Vulnerability", "url": "https://www.nodejs-security.com/blog/command-injection-flaws-in-ggit/", "published_at": "2025-08-09T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc62987d44", "title": "Command Injection Vulnerability in Create MCP Server STDIO Tool Exposes System Monitoring Functions", "url": "https://www.nodejs-security.com/blog/create-mcp-server-stdio-command-injection-vulnerability/", "published_at": "2025-07-19T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc633e30ab", "title": "GitHub Kanban MCP Server Command Injection Vulnerability Threatens Developer Workflows", "url": "https://www.nodejs-security.com/blog/github-kanban-mcp-server-command-injection-vulnerability/", "published_at": "2025-07-14T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc643e16de", "title": "Critical Command Injection Flaw in iOS Simulator MCP Server Exposes Development Environments", "url": "https://www.nodejs-security.com/blog/ios-simulator-mcp-server-command-injection-vulnerability/", "published_at": "2025-07-02T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc65033724", "title": "Command Injection Vulnerability Discovered in Codehooks MCP Server: A Critical Security Analysis", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-codehooks-mcp-server-security-analysis/", "published_at": "2025-06-28T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc65e5cd83", "title": "SSRF Shenanigans in safe-axios: Redirects Open the Backdoor", "url": "https://www.nodejs-security.com/blog/ssrf-vulnerability-safe-axios-dangerous-redirects/", "published_at": "2025-06-08T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc66627d82", "title": "SSRF Vulnerability in safe-axios: Unintended Public Address Classification", "url": "https://www.nodejs-security.com/blog/ssrf-vulnerability-safe-axios-wrong-public-address-classification/", "published_at": "2025-05-17T00:00:00+00:00" }, { "id": "01a087b1-0f46-723a-8f96-52fc6667e9bd", "title": "Bypassing SSRF Safeguards in ssrfcheck: A Case of Incomplete Denylists", "url": "https://www.nodejs-security.com/blog/bypassing-ssrf-safeguards-ssrfcheck/", "published_at": "2025-05-10T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06b254a8b", "title": "Don't Be Fooled by Multicast, SSRF Bypass in private-ip", "url": "https://www.nodejs-security.com/blog/dont-be-fooled-multicast-ssrf-bypass-private-ip/", "published_at": "2025-05-01T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06bdadb42", "title": "Node.js Authentication from Lucia to Better Auth", "url": "https://www.nodejs-security.com/blog/nodejs-authentication-migration-from-lucia-to-better-auth/", "published_at": "2025-04-15T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06ccd37ab", "title": "Bypassing SSRF Protection in nossrf: When Your Safeguards Become Loopholes", "url": "https://www.nodejs-security.com/blog/bypassing-ssrf-protection-nossrf/", "published_at": "2025-04-12T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06d8bbe02", "title": "Vue CLI Security Fix to Mitigate NPM Binary Planting", "url": "https://www.nodejs-security.com/blog/vue-cli-security-fix-npm-binary-planting/", "published_at": "2025-04-03T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06deb811e", "title": "Node.js API Security Vulnerabilities with Path Traversal in files-bucket-server", "url": "https://www.nodejs-security.com/blog/nodejs-api-security-vulnerabilities-path-traversal-files-bucket-server/", "published_at": "2025-03-29T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06e9276c1", "title": "Will You Accept These GPT 4o Secure Coding Recommendations?", "url": "https://www.nodejs-security.com/blog/will-you-accept-these-gpt-4o-secure-coding-recommendations/", "published_at": "2025-03-20T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06f518ddc", "title": "Command Injection Vulnerability in interactive-git-checkout npm package", "url": "https://www.nodejs-security.com/blog/command-injection-vulnerability-in-interactive-git-checkout/", "published_at": "2025-03-13T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea06fa88b5c", "title": "An Introduction to SSRF Bypasses and Denylist Failures", "url": "https://www.nodejs-security.com/blog/introduction-to-ssrf-bypasses-and-denylist-failures/", "published_at": "2025-03-05T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0707a527b", "title": "Disclosing a Command Injection Vulnerability in `git-checkout-tool`", "url": "https://www.nodejs-security.com/blog/disclosing-a-command-injection-vulnerability-in-git-checkout-tool/", "published_at": "2025-03-02T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0710384ad", "title": "Prisma Raw Query Leads to SQL Injection? Yes and No", "url": "https://www.nodejs-security.com/blog/prisma-raw-query-sql-injection/", "published_at": "2025-02-27T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea071b0e41a", "title": "Flawed Git Promises Library on npm Leads to Command Injection Vulnerability", "url": "https://www.nodejs-security.com/blog/flawed-git-promises-library-on-npm-leads-to-command-injection-vulnerability/", "published_at": "2025-02-17T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea071fe868e", "title": "Regex Gone Wrong: How parse-duration npm Package Can Crash Your Node.js App", "url": "https://www.nodejs-security.com/blog/regex-gone-wrong-parse-duration-npm-package-vulnerability/", "published_at": "2025-02-13T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0727d6c79", "title": "How I found an XSS in the Nuxt MDC Library for Markdown Content", "url": "https://www.nodejs-security.com/blog/nuxt-mdc-xss-vulnerability/", "published_at": "2025-02-11T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea072f1f9d3", "title": "Holes in the Safety Net: Bypassing SSRF Protection in safe-axios", "url": "https://www.nodejs-security.com/blog/bypassing-ssrf-protection-safe-axios/", "published_at": "2025-02-06T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0734d0cd2", "title": "How to Parse URLs from Markdown to HTML Securely?", "url": "https://www.nodejs-security.com/blog/how-to-parse-urls-from-markdown-to-html-securely/", "published_at": "2025-01-30T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea073512552", "title": "NPM Ignore Scripts Best Practices as Security Mitigation for Malicious Packages", "url": "https://www.nodejs-security.com/blog/npm-ignore-scripts-best-practices-as-security-mitigation-for-malicious-packages/", "published_at": "2025-01-23T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0738629cc", "title": "Where to find npm vulnerabilities?", "url": "https://www.nodejs-security.com/blog/where-to-find-npm-vulnerabilities/", "published_at": "2025-01-13T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0739d2f86", "title": "How to Hunt for IDOR Vulnerabilities To Exploit Security Misconfiguration?", "url": "https://www.nodejs-security.com/blog/how-to-hunt-for-idor-vulnerabilities-to-exploit-security-misconfiguration/", "published_at": "2025-01-03T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07402f5ca", "title": "How to Avoid JWT Security Mistakes in Node.js", "url": "https://www.nodejs-security.com/blog/how-avoid-jwt-security-mistakes-nodejs/", "published_at": "2024-12-19T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea074585aa4", "title": "Can a Node.js Secure Code Review Find Future Vulnerabilities?", "url": "https://www.nodejs-security.com/blog/nodejs-secure-code-review-find-future-vulnerabilities/", "published_at": "2024-12-06T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0751766c5", "title": "The Okta bcrypt Security Incident and The Bun vs Node.js Angle in Secure By Design", "url": "https://www.nodejs-security.com/blog/okta-bcrypt-security-incident-bun-nodejs/", "published_at": "2024-11-17T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea075a61337", "title": "NodeJS Path Traversal Vulnerability Scanner", "url": "https://www.nodejs-security.com/blog/nodejs-path-traversal-vulnerability-scanner/", "published_at": "2024-11-02T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea076340264", "title": "Do not use secrets in environment variables and here's how to do it better", "url": "https://www.nodejs-security.com/blog/do-not-use-secrets-in-environment-variables-and-here-is-how-to-do-it-better/", "published_at": "2024-10-06T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07645270e", "title": "How to use npm audit", "url": "https://www.nodejs-security.com/blog/how-to-use-npm-audit/", "published_at": "2024-10-02T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea076728963", "title": "How to use yarn audit", "url": "https://www.nodejs-security.com/blog/how-to-use-yarn-audit/", "published_at": "2024-09-26T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07703a441", "title": "Raw SQL Queries are Actually Better for Security Than ORMs?", "url": "https://www.nodejs-security.com/blog/raw-sql-queries-better-for-security-than-orms/", "published_at": "2024-09-22T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea077deaacc", "title": "Node API Security", "url": "https://www.nodejs-security.com/blog/node-api-security/", "published_at": "2024-09-10T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07885b64a", "title": "Is Node.js Secure?", "url": "https://www.nodejs-security.com/blog/is-nodejs-secure/", "published_at": "2024-09-09T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea079499992", "title": "URL Regex Validation: what can go wrong?", "url": "https://www.nodejs-security.com/blog/url-regex-validation/", "published_at": "2024-09-08T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea079c3c0e1", "title": "Uncovering a Prototype Pollution Regression in the core Node.js project", "url": "https://www.nodejs-security.com/blog/uncovering-a-prototype-pollution-regression-in-nodejs/", "published_at": "2024-08-16T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07aba2665", "title": "Deno CLI Vulnerability Repeats npm mistakes: CVE-2024-37150", "url": "https://www.nodejs-security.com/blog/deno-cli-vulnerability-repeats-npm-mistakes-cve-2024-37150/", "published_at": "2024-08-11T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07b07440f", "title": "Security skills for JavaScript developers", "url": "https://www.nodejs-security.com/blog/security-skills-for-javascript-developers/", "published_at": "2024-07-29T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07bb779b8", "title": "Understanding and Preventing Prototype Pollution in Node.js", "url": "https://www.nodejs-security.com/blog/understanding-and-preventing-prototype-pollution-in-nodejs/", "published_at": "2024-07-10T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07c8f1490", "title": "How to protect against a security breach in React Server Components", "url": "https://www.nodejs-security.com/blog/how-to-protect-against-a-security-breach-in-react-server-components/", "published_at": "2024-06-21T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07d3e13d5", "title": "IDOR Vulnerability: What is it and how to prevent it?", "url": "https://www.nodejs-security.com/blog/idor-vulnerability-what-is-it-and-how-to-prevent-it/", "published_at": "2024-06-16T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07d9c93df", "title": "The security vulnerability of serving images via a route as opposed to static middleware in Node.js", "url": "https://www.nodejs-security.com/blog/security-vulnerability-serving-images-via-route-nodejs/", "published_at": "2024-06-13T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07dc34131", "title": "Why is it considered a bad practice to write raw SQL commands?", "url": "https://www.nodejs-security.com/blog/why-it-considered-bad-practice-write-raw-sql-commands/", "published_at": "2024-06-06T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07e183dfc", "title": "JS Security Concepts for JavaScript Developers", "url": "https://www.nodejs-security.com/blog/js-security-concepts-javascript-developers/", "published_at": "2024-05-30T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07e32bc00", "title": "Secure Coding Practices in Node.js Against Path Traversal Vulnerabilities", "url": "https://www.nodejs-security.com/blog/secure-coding-practices-nodejs-path-traversal-vulnerabilities/", "published_at": "2024-05-23T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07e6e28fd", "title": "Secure JavaScript Coding Practices Against Command Injection Vulnerabilities", "url": "https://www.nodejs-security.com/blog/secure-javascript-coding-practices-against-command-injection-vulnerabilities/", "published_at": "2024-05-17T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07eeb5d01", "title": "To IDOR or Not to IDOR: Insecure Direct Object Reference in JavaScript Applications Explained", "url": "https://www.nodejs-security.com/blog/insecure-direct-object-reference-idor-javascript-applications/", "published_at": "2024-05-08T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07f821027", "title": "npm vulnerabilities: reviewing the security of your dependencies", "url": "https://www.nodejs-security.com/blog/npm-vulnerabilities-review/", "published_at": "2024-05-02T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07fc5fa57", "title": "Disclosing code injection vulnerabilities in safe-eval-2 npm package", "url": "https://www.nodejs-security.com/blog/disclosing-code-injection-vulnerabilities-in-safe-eval-2-npm-package/", "published_at": "2024-04-26T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea07fda0afa", "title": "Introducing Node.js Security Permissions Model, Threat Model, and Security Releases", "url": "https://www.nodejs-security.com/blog/introducing-nodejs-security-permissions-model-threat-model-and-security-releases/", "published_at": "2024-04-25T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea08043e6a8", "title": "Common Node.js Security Issues and How to Mitigate Them", "url": "https://www.nodejs-security.com/blog/common-nodejs-security-issues-mitigation/", "published_at": "2024-04-21T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea08109de3a", "title": "How JavaScript developers should embrace npm security", "url": "https://www.nodejs-security.com/blog/how-javascript-developers-should-embrace-npm-security/", "published_at": "2024-04-17T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea081740d6e", "title": "The XZ backdoor CVE-2024-3094: a JavaScript perspective", "url": "https://www.nodejs-security.com/blog/xz-backdoor-cve-2024-3094-javascript-perspective/", "published_at": "2024-03-31T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea08250a8ca", "title": "Node.js Security Best Practices", "url": "https://www.nodejs-security.com/blog/nodejs-security-best-practices/", "published_at": "2024-03-15T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea082e6cc6d", "title": "The Case for Node.js Secure Configuration", "url": "https://www.nodejs-security.com/blog/nodejs-secure-configuration/", "published_at": "2024-03-09T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea082ff0bd8", "title": "Protecting Against Common Node.js Vulnerabilities", "url": "https://www.nodejs-security.com/blog/protecting-against-common-nodejs-vulnerabilities/", "published_at": "2024-03-01T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0839f601b", "title": "Input Validation Security Best Practices for Node.js", "url": "https://www.nodejs-security.com/blog/input-validation-best-practices-for-nodejs/", "published_at": "2024-02-27T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea083f9e71b", "title": "A Node.js Vulnerability Scanner to Avoid Security Risks of EOL Runtime Versions", "url": "https://www.nodejs-security.com/blog/nodejs-vulnerability-scanner-eol/", "published_at": "2024-02-18T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea084578d48", "title": "JavaScript Security Issues in Node.js Applications", "url": "https://www.nodejs-security.com/blog/javascript-security-issues-nodejs-applications/", "published_at": "2024-02-05T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea085097356", "title": "OWASP Node.js Authentication, Authorization and Cryptography Practices", "url": "https://www.nodejs-security.com/blog/owasp-nodejs-authentication-authorization-cryptography-practices/", "published_at": "2024-01-20T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0852c739d", "title": "OWASP Node.js Best Practices Guide", "url": "https://www.nodejs-security.com/blog/owasp-nodejs-best-practices-guide/", "published_at": "2024-01-15T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea08618e2be", "title": "Secure JavaScript Coding to Avoid Insecure Direct Object References (IDOR)", "url": "https://www.nodejs-security.com/blog/secure-javascript-coding-to-avoid-insecure-direct-object-references-idor/", "published_at": "2024-01-13T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea08626f0a6", "title": "North Korea malware on npm and Ledger connect-kit crypto heist", "url": "https://www.nodejs-security.com/blog/north-korea-malware-on-npm-and-ledger-connect-kit-crypto-heist/", "published_at": "2023-12-28T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0862d0efb", "title": "10 Best Practices for Secure Code Review of Node.js code", "url": "https://www.nodejs-security.com/blog/ten-best-practices-for-secure-code-review-of-nodejs-code/", "published_at": "2023-12-20T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea0869e47a0", "title": "Node.js and OWASP Top Ten Command Injection: Don't Let Your App Go 'BOOM'", "url": "https://www.nodejs-security.com/blog/nodejs-and-owasp-top-ten-command-injection-dont-let-your-app-go-boom/", "published_at": "2023-11-27T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea086fe45fd", "title": "Secure Code Review Tips to Defend Against Vulnerable Node.js Code", "url": "https://www.nodejs-security.com/blog/secure-code-review-tips-to-defend-against-vulnerable-nodejs-code/", "published_at": "2023-11-08T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea087133748", "title": "Destroyed by Dashes: How Two Hyphens Cause Argument Injection Vulnerability in blamer npm Package", "url": "https://www.nodejs-security.com/blog/destroyed-by-dashes-how-two-hyphens-cause-argument-injection-vulnerability-in-blamer-npm-package/", "published_at": "2023-10-16T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea087146074", "title": "Securing Your Node.js Apps by Analyzing Real-World Command Injection Examples", "url": "https://www.nodejs-security.com/blog/securing-your-nodejs-apps-by-analyzing-real-world-command-injection-examples/", "published_at": "2023-09-15T00:00:00+00:00" }, { "id": "01a087b1-0f47-70e6-bdef-3ea087cec90a", "title": "An Introduction to Command Injection Vulnerabilities in Node.js and JavaScript", "url": "https://www.nodejs-security.com/blog/introduction-command-injection-vulnerabilities-nodejs-javascript/", "published_at": "2023-06-23T00:00:00+00:00" } ] posts Claim your blog
Back to nodejs-security.com
Blog · corpus.blog/blogs/nodejs-security.com/posts

nodejs-security.com

nodejs-security.com

2026

Hardening Your npm and pnpm Configs in the Age of Shai-Huludoriginal ↗
30 May 2026

2025

Argument Injection vulnerability in git-blame@1.4.0original ↗
22 Nov 2025
Argument Injection vulnerability in `gits@0.1.8`original ↗
22 Nov 2025
Command Injection vulnerability in `@fab1o/git@1.4.0`original ↗
22 Nov 2025
Command Injection vulnerability in `git-contributors` via unsanitized CLI argumentsoriginal ↗
22 Nov 2025
Command Injection vulnerability in `git-q@0.0.3`original ↗
22 Nov 2025
Command injection vulnerability via unsanitized CLI arguments in touxing/fast-git-cloneoriginal ↗
22 Nov 2025
Command Injection vulnerability in `willitmerge@0.2.1`original ↗
22 Nov 2025
A Directory Traversal Vulnerability I found in Mastra AI Frameworks MCP Serveroriginal ↗
29 Sept 2025
Mastering NPX: A Cheatsheet for npm and Node.js Power Usersoriginal ↗
25 Sept 2025
Mitigate Supply Chain Security with DevContainers and 1Password for Node.js Local Developmentoriginal ↗
22 Sept 2025
The Tale of the Vulnerable MCP Database Serveroriginal ↗
21 Sept 2025
Bad Security Defaults in Mastra AI Frameworks Templatesoriginal ↗
18 Sept 2025
SQL Injection and Bypassing "Read-Only" Mode in Xata's MCP Serveroriginal ↗
13 Sept 2025
Security Advisory for qix npm supply-chain compromise affecting debug and billions of weekly download usersoriginal ↗
9 Sept 2025
How to Mitigate SQL Bypass in MCP Serversoriginal ↗
7 Sept 2025
Enhancing MCP Server Security: A Guide to Using execFileoriginal ↗
5 Sept 2025
Argument Injection Vulnerability in ggitoriginal ↗
4 Sept 2025
How to Bypass Access Control in PostgreSQL in Simple PSQL MCP Server for SQL Injectionoriginal ↗
18 Aug 2025
Command Injection Flaws in ggit: Unveiling a Vulnerabilityoriginal ↗
9 Aug 2025
Command Injection Vulnerability in Create MCP Server STDIO Tool Exposes System Monitoring Functionsoriginal ↗
19 Jul 2025
GitHub Kanban MCP Server Command Injection Vulnerability Threatens Developer Workflowsoriginal ↗
14 Jul 2025
Critical Command Injection Flaw in iOS Simulator MCP Server Exposes Development Environmentsoriginal ↗
2 Jul 2025
Command Injection Vulnerability Discovered in Codehooks MCP Server: A Critical Security Analysisoriginal ↗
28 Jun 2025
SSRF Shenanigans in safe-axios: Redirects Open the Backdoororiginal ↗
8 Jun 2025
SSRF Vulnerability in safe-axios: Unintended Public Address Classificationoriginal ↗
17 May 2025
Bypassing SSRF Safeguards in ssrfcheck: A Case of Incomplete Denylistsoriginal ↗
10 May 2025
Don't Be Fooled by Multicast, SSRF Bypass in private-iporiginal ↗
1 May 2025
Node.js Authentication from Lucia to Better Authoriginal ↗
15 Apr 2025
Bypassing SSRF Protection in nossrf: When Your Safeguards Become Loopholesoriginal ↗
12 Apr 2025
Vue CLI Security Fix to Mitigate NPM Binary Plantingoriginal ↗
3 Apr 2025
Node.js API Security Vulnerabilities with Path Traversal in files-bucket-serveroriginal ↗
29 Mar 2025
Will You Accept These GPT 4o Secure Coding Recommendations?original ↗
20 Mar 2025
Command Injection Vulnerability in interactive-git-checkout npm packageoriginal ↗
13 Mar 2025
An Introduction to SSRF Bypasses and Denylist Failuresoriginal ↗
5 Mar 2025
Disclosing a Command Injection Vulnerability in `git-checkout-tool`original ↗
2 Mar 2025
Prisma Raw Query Leads to SQL Injection? Yes and Nooriginal ↗
27 Feb 2025
Flawed Git Promises Library on npm Leads to Command Injection Vulnerabilityoriginal ↗
17 Feb 2025
Regex Gone Wrong: How parse-duration npm Package Can Crash Your Node.js Apporiginal ↗
13 Feb 2025
How I found an XSS in the Nuxt MDC Library for Markdown Contentoriginal ↗
11 Feb 2025
Holes in the Safety Net: Bypassing SSRF Protection in safe-axiosoriginal ↗
6 Feb 2025
How to Parse URLs from Markdown to HTML Securely?original ↗
30 Jan 2025
NPM Ignore Scripts Best Practices as Security Mitigation for Malicious Packagesoriginal ↗
23 Jan 2025
Where to find npm vulnerabilities?original ↗
13 Jan 2025
How to Hunt for IDOR Vulnerabilities To Exploit Security Misconfiguration?original ↗
3 Jan 2025

2024

How to Avoid JWT Security Mistakes in Node.jsoriginal ↗
19 Dec 2024
Can a Node.js Secure Code Review Find Future Vulnerabilities?original ↗
6 Dec 2024
The Okta bcrypt Security Incident and The Bun vs Node.js Angle in Secure By Designoriginal ↗
17 Nov 2024
NodeJS Path Traversal Vulnerability Scanneroriginal ↗
2 Nov 2024
Do not use secrets in environment variables and here's how to do it betteroriginal ↗
6 Oct 2024
How to use npm auditoriginal ↗
2 Oct 2024
How to use yarn auditoriginal ↗
26 Sept 2024
Raw SQL Queries are Actually Better for Security Than ORMs?original ↗
22 Sept 2024
Node API Securityoriginal ↗
10 Sept 2024
Is Node.js Secure?original ↗
9 Sept 2024
URL Regex Validation: what can go wrong?original ↗
8 Sept 2024
Uncovering a Prototype Pollution Regression in the core Node.js projectoriginal ↗
16 Aug 2024
Deno CLI Vulnerability Repeats npm mistakes: CVE-2024-37150original ↗
11 Aug 2024
Security skills for JavaScript developersoriginal ↗
29 Jul 2024
Understanding and Preventing Prototype Pollution in Node.jsoriginal ↗
10 Jul 2024
How to protect against a security breach in React Server Componentsoriginal ↗
21 Jun 2024
IDOR Vulnerability: What is it and how to prevent it?original ↗
16 Jun 2024
The security vulnerability of serving images via a route as opposed to static middleware in Node.jsoriginal ↗
13 Jun 2024
Why is it considered a bad practice to write raw SQL commands?original ↗
6 Jun 2024
JS Security Concepts for JavaScript Developersoriginal ↗
30 May 2024
Secure Coding Practices in Node.js Against Path Traversal Vulnerabilitiesoriginal ↗
23 May 2024
Secure JavaScript Coding Practices Against Command Injection Vulnerabilitiesoriginal ↗
17 May 2024
To IDOR or Not to IDOR: Insecure Direct Object Reference in JavaScript Applications Explainedoriginal ↗
8 May 2024
npm vulnerabilities: reviewing the security of your dependenciesoriginal ↗
2 May 2024
Disclosing code injection vulnerabilities in safe-eval-2 npm packageoriginal ↗
26 Apr 2024
Introducing Node.js Security Permissions Model, Threat Model, and Security Releasesoriginal ↗
25 Apr 2024
Common Node.js Security Issues and How to Mitigate Themoriginal ↗
21 Apr 2024
How JavaScript developers should embrace npm securityoriginal ↗
17 Apr 2024
The XZ backdoor CVE-2024-3094: a JavaScript perspectiveoriginal ↗
31 Mar 2024
Node.js Security Best Practicesoriginal ↗
15 Mar 2024
The Case for Node.js Secure Configurationoriginal ↗
9 Mar 2024
Protecting Against Common Node.js Vulnerabilitiesoriginal ↗
1 Mar 2024
Input Validation Security Best Practices for Node.jsoriginal ↗
27 Feb 2024
A Node.js Vulnerability Scanner to Avoid Security Risks of EOL Runtime Versionsoriginal ↗
18 Feb 2024
JavaScript Security Issues in Node.js Applicationsoriginal ↗
5 Feb 2024
OWASP Node.js Authentication, Authorization and Cryptography Practicesoriginal ↗
20 Jan 2024
OWASP Node.js Best Practices Guideoriginal ↗
15 Jan 2024
Secure JavaScript Coding to Avoid Insecure Direct Object References (IDOR)original ↗
13 Jan 2024

2023

North Korea malware on npm and Ledger connect-kit crypto heistoriginal ↗
28 Dec 2023
10 Best Practices for Secure Code Review of Node.js codeoriginal ↗
20 Dec 2023
Node.js and OWASP Top Ten Command Injection: Don't Let Your App Go 'BOOM'original ↗
27 Nov 2023
Secure Code Review Tips to Defend Against Vulnerable Node.js Codeoriginal ↗
8 Nov 2023
Destroyed by Dashes: How Two Hyphens Cause Argument Injection Vulnerability in blamer npm Packageoriginal ↗
16 Oct 2023
Securing Your Node.js Apps by Analyzing Real-World Command Injection Examplesoriginal ↗
15 Sept 2023
An Introduction to Command Injection Vulnerabilities in Node.js and JavaScriptoriginal ↗
23 Jun 2023