Node.js Vulnerabilities

A document summarizing the types, cases, and countermeasures of security vulnerabilities arising in the Node.js runtime and npm ecosystem.

Node.js Vulnerabilities

Overview

Node.js vulnerabilities collectively refer to security flaws found in the Node.js core—a server-side JavaScript runtime based on the V8 engine—and across the npm package ecosystem built on top of it. A single runtime flaw can affect millions of services simultaneously, and because dependency graphs are deep, the ecosystem is particularly vulnerable to supply chain attacks. Therefore, a threefold defense is required: core updates, dependency management, and application coding practices.

Key Details

1. Classification of Vulnerabilities

Node.js-related vulnerabilities are largely divided into three layers. First, core runtime vulnerabilities, which the Node.js Foundation patches directly and distributes as Security Releases. Second, npm ecosystem vulnerabilities, handled by individual package maintainers and introduced indirectly through transitive dependencies. Third, application code vulnerabilities, which arise from developers' coding practices while the runtime itself operates normally.

2. Core Runtime Vulnerabilities

HTTP request smuggling and HTTP/2-related attacks: Exploit differences in header interpretation between proxies and backends. CVE-2023-44487 (HTTP/2 Rapid Reset) is a representative case that affected many Node.js versions.
Command injection: CVE-2024-27980 is a flaw in which insufficient argument validation when child_process.spawn processes .bat/.cmd files on Windows allowed arbitrary command execution.
Prototype Pollution: A type in which __proto__, constructor, and prototype keys are not filtered in object merge logic, polluting the global prototype; it is repeatedly reported in both core utilities and third-party libraries.
Path Traversal: Occurs when validation of ../ sequences is missing in combinations of fs and path APIs, and is frequent in static file server implementations.
ReDoS: Due to the characteristics of V8's regex engine, patterns that cause exponential backtracking occupy the event loop and paralyze the entire service. The impact is especially large because of the single-threaded model.
Permission Model bypass: Several flaws have been reported that bypass filesystem and child process access controls in the experimental permission model introduced in Node.js 20.

3. npm Ecosystem and Supply Chain Risks

npm is a graph structure in which millions of packages are intertwined, and it is a major target for supply chain attacks through malicious package distribution, typosquatting, and account takeover. Representative examples include the past event-stream incident, account takeover cases involving ua-parser-js and colors, and worm cases that steal credentials using install scripts (preinstall, postinstall). Dependency confusion, old transitive dependencies maintained indefinitely, and logic-level malicious code that npm audit cannot detect are also cited as problems.

4. Application-Level Vulnerabilities

Code execution due to improper use of eval, new Function, and the vm module
Propagation of prototype pollution through JSON.parse and deserialization paths
Missing JWT verification, session fixation, CORS misconfiguration
Denial of service (DoS) due to event loop blocking
SSRF due to misconfiguration of http-proxy-related middleware

5. Detection and Response

npm audit, npm audit fix, SCA (software composition analysis) tools, SBOM generation, automated updates via Dependabot and Renovate, ESLint security plugins, --frozen-lockfile and lockfile commits, and vulnerability gates in the CI stage have become standard countermeasures. On the runtime side, maintaining the latest LTS version, enabling --experimental-permission (permission model), running containers as non-root, and setting --max-old-space-size and request size limits are recommended.

Latest Trends

The biggest changes in 2024-2025 are the maturing of the permission model and the institutionalization of supply chain security. The permission model introduced experimentally in Node.js 20 is entering a stabilization phase in the 22 and 23 lines, making it possible to declaratively restrict filesystem, network, and child process access. At the same time, the npm registry has expanded provenance attestations and mandatory two-factor authentication, and adoption of the SLSA framework and signed package distribution have become recommended practices.

In addition, the 2024 Windows command injection (CVE-2024-27980) and HTTP/2-related denial-of-service issues were patched in successive security releases, and in 2025, as worm-type attacks stealing tokens and credentials through the large-scale distribution of malicious npm packages were reported, "dependency minimization" and "blocking install scripts (--ignore-scripts)" were emphasized as practical standards. Furthermore, as code generated by AI coding assistants flows in without verification, security review processes for automatically generated code have emerged as a new issue.