BERRY9 IT Services, home +91 86868 92922

Node.js Security Pitfalls: From Prototype Pollution to SSRF

Node.js is everywhere, and its ecosystem moves fast and produces a steady stream of footguns. Here are seven patterns that turn up often in code reviews.

Request a scoping call Call +91 86868 92922

Source code · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed

1. Prototype pollution

Discussed at length in prototype pollution in 2025. Any deep-merge or recursive-assign on user input is a candidate. Vulnerable lodash versions, home-rolled merge functions, anything that does not explicitly reject __proto__.

2. SSRF via URL libraries

Many Node apps fetch URLs on the server's behalf. node-fetch, axios, got — all happily follow redirects, by default. An attacker who can submit a URL that 302s to http://169.254.169.254 gets cloud metadata. Defense: resolve DNS, validate IP, restrict redirects.

3. Path traversal via path.join

path.join(uploadDir, userFilename) looks safe. It is not — ../../../etc/passwd in userFilename produces exactly what you expect. Use path.resolve and check the result starts with the intended base directory.

4. Unsafe deserialization

Older patterns: node-serialize.unserialize, funcster, anything that accepts a function-serialized string. Newer pattern: JSON parsing into class instances via libraries that auto-instantiate. Untrusted input deserialized into a typed object is RCE.

5. Child process arguments

exec("git log " + userInput) is shell injection. execFile is safer if arguments are passed as an array. spawn with shell:true is exec, not spawn.

6. NoSQL injection

MongoDB queries built by spreading req.body into the filter. { password: { $ne: null } } matches any user with any password.

7. Dependency confusion and supply chain

Private npm package names that overlap with public ones, lockfile not committed, scripts running on install (postinstall). The supply-chain surface for Node is enormous.

See source code review.

Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.

Plan your next security test

Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.

Request a scoping call WhatsApp