Record · corpus.blog/posts/01a0823c-852f-7201-920b-e058618d3030

Node.js Trust Falls: Dangerous Module Resolution on Windows

ZDI Blog · published 8 April 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at thezdi.com Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
Links from this post: 20
Words captured: 1,521

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://docs.npmjs.com/cli/v11

docs.npmjs.com

https://nodejs.org/en

nodejs.org

https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ

groups.google.com

https://github.com/nodejs/node-v0.x-archive/issues/8830

github.com

https://github.com/nodejs/node/security/policy

github.com

https://nodejs.org/api/modules.html

nodejs.org

https://docs.npmjs.com/cli/v11/configuring-npm/package-json

docs.npmjs.com

https://github.com/npm/cli/blob/977fd5784f875fdc2e3436ed15c444ddca63e3d7/node_modules/promise-inflight/inflight.js

github.com

https://jira.mongodb.org/browse/COMPASS-9058

jira.mongodb.org

https://jira.mongodb.org/browse/MONGOSH-2028

jira.mongodb.org

https://x.com/bobbygould5

x.com

https://x.com/izobashi

x.com

https://www.twitter.com/thezdi

twitter.com

https://infosec.exchange/@thezdi

infosec.exchange

https://www.linkedin.com/company/zerodayinitiative

linkedin.com

https://bsky.app/profile/thezdi.bsky.social

bsky.app

https://bounty.github.com/ineligible.html

bounty.github.com

https://github.com/npm/cli/pull/1438/changes

github.com

https://docs.npmjs.com/cli/v10/configuring-npm/package-json

docs.npmjs.com

https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ?pli=1

groups.google.com