OWASP Top 10 Vulnerabilities in Node.js
summary
Covers concrete OWASP Top 10 failures in Node.js with exploit examples and fixes: SSRF via axios where user-supplied URLs fetch internal services, undici HTTP smuggling CVEs that hide extra requests, deserialization leading to RCE from unsafe JSON libs, and widespread broken access control allowing data tampering. Recommends validating and sanitizing inputs, disabling redirects, JSON structured logging with alerting, automated dependency updates (Dependabot/Snyk/npm audit), checking package signatures/hashes, Terraform/Ansible for repeatable configs, bcrypt for passwords, MFA and short-lived tokens.
AI-written summary · about
chapters (13)
- 0:00OWASP Top 10 in Node.js
- 1:45Server Side Request Forgery
- 4:13Security logging failures
- 7:10Remediation for logging
- 8:15Data integrity failures
- 11:27Authentication failures
- 14:40Outdated components
- 18:16Security misconfiguration
- 20:51Insecure design
- 22:38Injection vulnerabilities
- 26:35Cryptographic failures
- 28:43Broken access control
- 31:00Summary & Q&A
