Contents
In brief
It is easy to ship a fast Node.js backend to production with “quiet” holes — not in business logic, but in regex, dependencies, object merging, and config. A Dev.to overview lists seven common vulnerability classes; useful as a pre-release checklist.
What happened
The author describes scenarios where teams lost data over small mistakes: ReDoS from user input, a malicious package in the npm chain, prototype pollution via Object.assign / lodash.merge, secrets in .env without rotation, NoSQL injection in MongoDB queries.
These are not headline zero-days but accumulated small errors in a typical Express / Fastify / Nest stack.
Why it matters
The Node ecosystem rewards speed: npm install, copy-paste middleware, deploy. Security often waits until a scanner fires or an incident happens.
Key risks from the article:
| Threat | What it is | Minimum defense |
|---|---|---|
| ReDoS | Malicious input breaks regex; event loop stalls | Audit regex, input length limits, timeouts |
| Supply chain | Compromised package in node_modules |
npm audit, lockfile, npm ci, review maintainers |
| Prototype pollution | __proto__ tampering via merge |
Safe merge, Object.create(null), JSON Schema |
| Secrets | Keys in env without vault | Secret manager, rotation, never log env |
| NoSQL injection | Object instead of string in query | Schema validation, parameterization, field allowlists |
In practice
- Before production — run
npm audit/ OSV / Dependabot and fix critical CVEs in the lockfile. - Input — Zod/Valibot at the API boundary; do not trust
req.bodyin database queries. - Merge — do not merge arbitrary client JSON into config/profile; for deep merge use libraries with pollution protection.
- Regex — avoid nested quantifiers on user strings; when unsure, use something like
safe-regexor skip regex. - CI — SAST plus secret scanning (gitleaks, GitHub secret scan).
For small projects discipline is enough; for enterprise, the same points in policy and review.
Takeaway
The article reminds us: Node security is not only HTTPS and helmet. ReDoS and pollution hurt as much as SQL injection elsewhere. Walk through the checklist quarterly or when major dependencies change.