OWASP Top 10 Vulnerabilities in Node.js
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 15:40· Room 5HTERRAZA (Floor 5), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Overview of OWASP Top 10 applied to Node.js with concrete examples: undici 5.x HTTP smuggling CVE that triggers server‑side requests and hides attacker activity, a deserialization vulnerability that executes arbitrary code from tampered cookies, and widespread broken access control allowing users to read or act on other users' data. Remediations include input validation, signing packages and checking hashes, automated dependency‑update workflow opening weekly PRs, short‑lived tokens, MFA, cookie flags and log JSON to centralized log managers for alerting and forensic context.
AI-written summary · about
chapters (13)
- 0:00OWASP Top 10 in Node.js
- 1:45Server Side Request Forgery
- 4:13Security logging failures
- 7:10Remediation for logging
- 8:15Data integrity failures
- 11:27Authentication failures
- 14:40Outdated components
- 18:16Security misconfiguration
- 20:51Insecure design
- 22:38Injection vulnerabilities
- 26:35Cryptographic failures
- 28:43Broken access control
- 31:00Summary & Q&A
related talks
32mOWASP Top 10 Vulnerabilities in Node.js
56mNode.js Security
35mSecure development in NodeJS: OWASP top ten and JWT best practices
21mThe Security Toolbox For Node
27mState of Node.js Security
38mThe Security Toolbox For Node
01h 02mUnderstanding the OWASP Top 10
53mOWASP Top 10: What are them and how to prevent them