Node.js Security

Node.js and Express Security Audit

npm install security-risk

Sherlock Forensics provides Node.js and Express security audits covering prototype pollution, ReDoS (regex denial of service), dependency confusion, npm audit findings, middleware ordering issues, SSRF through axios/node-fetch, insecure session management and missing helmet.js headers. Quick audits from $1,500 CAD. Standard penetration tests from $5,000 CAD.

Node.js applications inherit the security posture of every package in their dependency tree. The average Express application pulls in hundreds of transitive dependencies, each one a potential attack vector. Prototype pollution can bypass authentication. A single regex pattern can freeze your event loop. Dependency confusion attacks substitute internal packages with malicious public ones. Express itself ships with no security headers, no rate limiting and no input validation. We audit Node.js applications from the package.json through the middleware stack to every API endpoint.

Order a Quick Audit - $1,500 Scope a Full Pentest

What We Find

Node.js and Express Vulnerabilities We Test For

01 - Prototype

Prototype Pollution

Prototype pollution exploits JavaScript's prototypal inheritance by injecting properties into Object.prototype through vulnerable merge, deep clone and extend functions found in popular npm packages. A single polluted property propagates to every object in your application. Attackers use this to bypass authentication by injecting isAdmin properties, corrupt application state, trigger denial of service and in server-side contexts achieve remote code execution through template engines. We audit your dependency tree for known prototype pollution vectors and test input paths that reach vulnerable functions.

02 - ReDoS

ReDoS (Regex Denial of Service)

Regular expressions with catastrophic backtracking can freeze your Node.js event loop with a single crafted input string. Because Node.js is single-threaded, a regex that takes minutes to evaluate blocks all request processing, effectively taking down your entire application. ReDoS vulnerabilities hide in input validation, URL parsing, email validation, user agent parsing and any regex applied to user-controlled input. We analyze your regex patterns for exponential backtracking and test input validation endpoints with crafted payloads.

03 - Deps

Dependency Confusion

Dependency confusion attacks exploit the way npm resolves package names. If your application uses private packages with names that do not exist on the public npm registry, an attacker can publish a malicious package with the same name and a higher version number. When npm resolves dependencies, it may install the public malicious package instead of your private one, executing attacker code during installation. We check your package configuration for dependency confusion risk, verify registry scoping and identify internal package names that could be claimed publicly.

04 - Audit

npm Audit Findings

npm audit identifies known vulnerabilities in your dependency tree, but many teams ignore its output because of false positives, breaking changes in updates and the sheer volume of findings. However, some npm audit findings are genuinely critical and exploitable. We triage your npm audit results to distinguish between theoretical vulnerabilities and genuinely exploitable issues. We test whether vulnerable dependencies are reachable from user input and assess the real-world risk of each finding rather than just reporting severity numbers.

05 - Middleware

Middleware Ordering Issues

Express middleware runs in the order it is defined, and incorrect ordering creates security gaps. Authentication middleware defined after route handlers means those routes run unauthenticated. CORS middleware after body parsing means preflight checks may not apply. Rate limiting after expensive operations means the damage is done before the limit kicks in. Error handling middleware in the wrong position leaks stack traces. We review your middleware stack ordering, identify security-critical middleware that runs too late and verify that authentication and authorization apply to every protected route.

06 - SSRF

SSRF Through axios/node-fetch

Server-side request forgery occurs when your Node.js application makes HTTP requests to URLs controlled by user input. With libraries like axios, node-fetch, got and the built-in http module, attackers can make your server request internal services, cloud metadata endpoints (169.254.169.254), localhost admin panels and private network resources. SSRF in cloud environments can expose IAM credentials, database connection strings and infrastructure secrets. We test every endpoint that accepts URLs or makes server-side HTTP requests for SSRF vulnerabilities.

07 - Session

Insecure Session Management

Express session management through express-session requires careful configuration that many applications get wrong. Common issues include using the default MemoryStore in production (memory leak and no persistence), predictable or hardcoded session secrets, missing cookie flags (httpOnly, secure, sameSite), excessive session lifetimes, session fixation through failure to regenerate IDs after authentication and session data stored in client-accessible cookies. We test your session implementation for all these weaknesses and verify that session invalidation works correctly on logout.

08 - Headers

Missing helmet.js Headers

Express does not set security headers by default. Without helmet.js or manual header configuration, your application is missing Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, X-XSS-Protection and other headers that protect against common attacks. Missing CSP enables XSS through inline scripts. Missing HSTS allows SSL stripping. Missing X-Frame-Options enables clickjacking. We test your response headers on every endpoint and verify that security headers are properly configured with restrictive values rather than permissive defaults.

Our Approach

How We Audit Node.js Applications

Dependency Tree Analysis

We analyze your package.json, lock file and entire transitive dependency tree. We go beyond npm audit by testing whether vulnerable packages are actually reachable from user input, checking for dependency confusion risk, identifying typosquatting packages, flagging unmaintained dependencies and assessing the real-world exploitability of each finding. Your dependency tree is your largest attack surface and deserves thorough analysis.

Middleware Stack Review

We map your complete Express middleware stack including the order of authentication, authorization, CORS, body parsing, rate limiting, logging and error handling middleware. We identify security-critical middleware that runs too late, routes that bypass authentication, error handlers that leak information and middleware configuration that weakens security. This ordering review catches vulnerabilities that endpoint testing alone cannot find.

API Endpoint Testing

We test every API endpoint for injection vulnerabilities, authentication bypass, authorization flaws, rate limiting gaps, input validation weaknesses and business logic issues. We test with crafted payloads designed for Node.js-specific vulnerabilities including prototype pollution through JSON bodies, ReDoS through string parameters and SSRF through URL inputs.

Configuration and Environment Review

We review your Node.js configuration including environment variable management, session configuration, CORS settings, body parser limits, helmet.js setup, logging configuration and error handling. We verify that development settings do not reach production, that secrets are properly managed and that the application fails securely when errors occur.

Pricing

Node.js Security Engagements

Quick Audit - $1,500 CAD
Focused security review covering dependency analysis, prototype pollution testing, session security, helmet.js configuration and common Express vulnerabilities. Ideal for APIs and small applications. Delivered in 3-5 business days. Order online.
Standard Penetration Test - $5,000 CAD
Full penetration test covering all eight vulnerability categories, middleware stack review, SSRF testing, ReDoS analysis, dependency confusion checks, authentication and authorization across all endpoints. For production APIs and applications. Order online.
Comprehensive Assessment - $12,000 CAD
Full-scope assessment including source code review, infrastructure testing, CI/CD pipeline review, deep dependency analysis, container security and remediation support. For enterprise Node.js applications. Contact us to scope.

Frequently Asked Questions

Node.js Security FAQs

Is Node.js secure?
Node.js core receives regular security updates and is reasonably secure. The risk comes from the npm ecosystem and the dependency model. The average Node.js application pulls in hundreds of packages, each of which could contain vulnerabilities, malicious code or supply chain attacks. Express provides minimal security defaults, and most security-critical features require additional packages and correct configuration. A Node.js security audit examines both your code and your entire dependency tree.
What are common Express vulnerabilities?
The most common Express vulnerabilities we find include missing helmet.js security headers, middleware ordering issues where authentication runs after route handlers, insecure session configuration with default MemoryStore and weak secrets, CORS misconfiguration allowing credential-bearing cross-origin requests, error handlers that leak stack traces and internal details, missing rate limiting on authentication endpoints and body parser configuration that allows denial of service through large payloads.
How do I secure an npm project?
Run npm audit regularly and prioritize critical findings. Use a lock file and commit it to version control. Enable two-factor authentication on your npm account. Use scoped packages (@org/package) to prevent dependency confusion. Review new dependencies before installation. Remove packages you no longer use. Keep Node.js on the latest LTS version. Use tools like Socket.dev for supply chain attack detection. Sherlock Forensics provides dependency analysis that goes beyond npm audit to find exploitable vulnerabilities.
What is prototype pollution?
Prototype pollution is a JavaScript vulnerability where attackers inject properties into Object.prototype through vulnerable merge, clone or extend functions. Because all objects inherit from Object.prototype, a single polluted property affects every object in your application. This enables authentication bypass by injecting properties like isAdmin=true, denial of service by corrupting application state and remote code execution through template engine exploitation. Many popular npm packages have had prototype pollution vulnerabilities.
Do Node.js APIs need pentesting?
If your Node.js API handles user data, authenticates users, processes payments or serves as the backend for a web or mobile application, it needs a penetration test. Node.js APIs have unique attack surfaces that generic scanners miss, including prototype pollution, ReDoS, dependency confusion and middleware ordering vulnerabilities. Sherlock Forensics offers Node.js-specific security audits starting at $1,500 CAD with results in 3-5 business days.

Get Started

Your Node.js app is only as secure as its weakest dependency.

Quick audits from $1,500 CAD. Standard penetration tests from $5,000 CAD.

Order Online

Secure Your Node.js Application

Tell us about your Node.js stack, your framework (Express, Fastify, NestJS) and your security concerns. We will recommend the right assessment for your application.

Call 604.229.1994
Phone
604.229.1994
Burnaby Office
Burnaby, BC, Canada
Coquitlam Office
Coquitlam, BC, Canada