node-js
Safeguard articles tagged "node-js" — guides, analysis, and best practices for software supply chain and application security.
27 articles
NoSQL injection prevention in MongoDB and Mongoose
A single unsanitized query key like $ne can bypass authentication in MongoDB apps — two 2024-2025 Mongoose CVEs show the fix is harder than one middleware package.
Implementing HSTS correctly in Node.js and Express
HSTS has one header and three flags, yet a misconfigured includeSubDomains or a premature preload submission can take a domain offline for months.
Safely Parsing Untrusted URLs in Node.js
Node's legacy url.parse() is deprecated (DEP0169), and parser mismatches between it, the WHATWG URL API, and fetchers are a documented root cause of SSRF and open redirects.
Generating a CycloneDX/SPDX SBOM for a Node.js Application
npm has shipped a native `npm sbom` command since v9 — but a real supply chain program needs more than the CLI default. Here's how to do it right.
Implementing SSL/TLS certificate pinning in Node.js
HTTP Public Key Pinning died in Chrome 67 back in 2018, yet Node.js apps still need pinning for mobile backends and server-to-server calls — here's how to do it without bricking your own API.
How to Audit npm Dependencies for Vulnerabilities
Go beyond npm audit's noisy output — resolve your dependency tree, prioritize by reachability, and fix both direct and transitive vulnerabilities in a Node.js project the right way.
XXE Prevention in JavaScript: Disabling libxmljs noent
How the libxmljs noent option silently reopens XML External Entity (XXE) attacks in Node.js apps, and the exact parser settings that shut it down for good.
Docker Image for Node: Choosing Slim vs Full Builds
The default node image on Docker Hub ships a full Debian userland most services never touch — knowing when slim, alpine, or distroless actually pays off keeps builds smaller without breaking native modules.
superagent npm: Security Review and Safe HTTP Requests
SuperAgent is a mature HTTP client for Node.js, but old versions carry prototype pollution and information-exposure flaws. Here is a practical security review.
Choosing a Docker Node Version: A Security Guide
The Docker Node version you pin decides your patch cadence, image size, and vulnerability exposure. Here is how to pick and maintain a Node base image safely.
http-proxy-middleware on npm: Security Review and Safe Usage
http-proxy-middleware is a widely used npm proxy library that has shipped two notable CVEs. Here is what to pin, what to patch, and how to use it safely.
Docker and npm: How to Build Secure Node.js Images
Combining Docker and npm the naive way ships a bloated, vulnerable image. Here is how to build lean, reproducible, and secure Node.js containers.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.