Security Blog

Insights, guides, and best practices for JavaScript security

GitHub ActionsCI/CD SecurityNode.jsNext.jsSupply ChainDevSecOpsnpm

Securing GitHub Actions for Node.js and Next.js: Pwn Requests, Cache Poisoning, and npm Provenance [2026]

Your CI pipeline holds the npm token, the cloud credentials, and the production deploy key, which makes it the highest-value target in the repository. This guide walks through the attack patterns that actually work against Node.js and Next.js workflows (`pull_request_target` pwn requests, script injection through `${{ }}` interpolation, cache and artifact poisoning, tag-retagging supply chain attacks such as CVE-2025-30066), then hardens them: least-privilege `GITHUB_TOKEN`, actions pinned to commit SHAs, OIDC trusted publishing instead of a long-lived `NPM_TOKEN`, protected environments, and a copy-paste hardening checklist.

2026-09-29Read more →

DockerContainer SecurityNode.jsNext.jsSupply ChainDevSecOpsDockerfile

Docker Security for Node.js Deployments: Hardened Images, Non-Root Containers, and Builds Without Leaked Secrets [2026]

Your container is not a security boundary — it is a process with a shared kernel and, by default, more privileges than the application it runs. This guide hardens Node.js and Next.js deployments end to end: pinned and minimal base images, multi-stage builds where build tools and secrets never reach the runtime layer, BuildKit secret mounts instead of ARG/ENV, non-root users, read-only root filesystems, dropped capabilities, `no-new-privileges`, pids and memory limits, image scanning with Trivy, SBOMs, cosign signatures, and the one mount that undoes all of it — the Docker socket.

2026-09-22Read more →

IDORBroken Access ControlAuthorizationOWASPNext.jsNode.jsPrismaAPI Security

IDOR and Broken Access Control in Next.js and Node.js: Object-Level Authorization That Holds [2026]

Your login is working, and that is exactly the problem: authentication tells you who is asking, not what they are allowed to touch. Broken Access Control has been the #1 category in the OWASP Top 10 since 2021, and IDOR is its most common concrete form — change one ID in the URL and read another tenant's invoice. Here's why JavaScript stacks leak object references, the seven rules that close the hole (session-derived scoping, the ownership predicate inside the query, 404 instead of 403, one authorization chokepoint), why middleware cannot save you, how Server Actions and RSC arguments become client input, and the two-account regression suite that keeps it shut.

2026-09-15Read more →

WebSocketCSWSHRealtimeNode.jsNext.jsAPI SecurityAuthorizationOWASP

WebSocket Security in Node.js and Next.js: CSWSH, Origin Checks, and Hardening Real-Time APIs [2026]

Your REST API is locked down and your WebSocket endpoint is wide open. Real-time features — chat, live dashboards, collaborative cursors, streaming AI tokens — bypass the entire HTTP security model: no per-message origin checks, no CSRF machinery, no middleware chain. An attacker who can open a socket in a victim's browser can read and write through it with the victim's authority. Here's how Cross-Site WebSocket Hijacking (CSWSH) actually works in Node.js, the origin checks and upgrade-time authentication that stop it, and how to authorize every message, rate-limit connections, and keep real-time APIs from becoming your biggest data leak.

2026-09-08Read more →

WebAuthnPasskeysAuthenticationPhishingNode.jsNext.jsSecurity

WebAuthn and Passkeys in Node.js and Next.js: Phishing-Resistant Authentication [2026]

MFA fatigue, OTP interception, AI-driven phishing kits: passwords and one-time codes are the weakest link in your login flow. Passkeys replace shared secrets with origin-bound public-key cryptography — nothing to steal, nothing to relay. Here's how WebAuthn actually works, how to implement registration and authentication with SimpleWebAuthn in Next.js, and the counter, recovery, and UX pitfalls that separate a secure rollout from a broken one.

2026-09-01Read more →

Supply ChainDependency ConfusionTyposquattingnpm SecurityCI/CDLockfileOpen Source Security

Dependency Confusion and Typosquatting in npm: Defend Your Node.js Pipeline from Hijacked Installs [2026]

The scariest supply-chain attacks never touch a CVE — they hijack a package name. Dependency confusion and typosquatting turn a routine `npm install` into remote code execution on your laptop or CI runner. Here's how npm's resolution order gets weaponized, why version pinning won't save you, and the registry, lockfile, and CI defenses that keep attacker code out of your build.

2026-08-25Read more →

Node.jsRace ConditionsBusiness LogicTOCTOUTransactionsIdempotencyPostgreSQLAPI SecurityOWASP

Race Conditions and Business Logic Flaws in Node.js: Atomic Endpoints and TOCTOU Defenses [2026]

Your auth can be bulletproof while attackers drain your balance two requests at a time. Business logic flaws and race conditions are how 'correct' code loses money and data. Here's how check-then-act bugs actually happen in Node.js, and the atomic fixes — conditional updates, row-locked transactions, unique constraints, and idempotency keys — that close them.

2026-08-18Read more →

Node.jsNext.jsSQL InjectionNoSQL InjectionPrismaMongoDBDatabase SecurityOWASP

SQL and NoSQL Injection Prevention in Node.js: ORM Safety and Parameterized Queries [2026]

Injection is still the #1 web application risk — and ORMs are not bulletproof. Here's how SQL injection and NoSQL injection actually happen in Node.js, which ORM APIs are safe, and a defense-in-depth strategy for Prisma, Knex, Sequelize, and MongoDB.

2026-08-11Read more →

Node.jsNext.jsSecrets ManagementEnvironment VariablesDevSecOpsCI/CDDockerAPI Keys

Secrets Management for Node.js and Next.js: Protect Your API Keys in 2026

Leaked API keys, committed .env files, and secrets baked into Docker images are how most startups get breached. Here's a production-grade secrets management strategy for Node.js and Next.js: env validation, git history hygiene, vaults, CI/CD masking, and rotation.

2026-08-04Read more →

JavaScriptNode.jsPrototype PollutionObject SecurityOWASP Top 10Backend SecurityInput Validation

Prototype Pollution in JavaScript and Node.js: Prevention Guide for 2026

Prototype pollution is one of the most misunderstood yet dangerous vulnerabilities in JavaScript applications. Here's how it works, how attackers exploit it in Node.js and React/Next.js apps, and the concrete patterns — safe merge, Object.create(null), schema validation, and defensive coding — you need to prevent it.

2026-07-28Read more →

Node.jsNext.jsFile UploadAPI SecurityOWASP Top 10Web SecurityBackend Security

Secure File Upload in Node.js and Next.js: Defenses, Code Examples, and Audit Checklist [2026]

File upload is one of the most exploited attack surfaces in modern web apps. Learn how to secure file uploads in Node.js and Next.js — with production-grade code for validation, sanitization, malware scanning, and a complete audit checklist for your next security review.

2026-07-21Read more →

GraphQLNode.jsNext.jsAPI SecurityApolloRate LimitingAuthorizationOWASP Top 10

GraphQL Security for Node.js and Next.js: Attacks, Defenses, and Production Checklists

GraphQL gives clients enormous power — and that power can be weaponized. Learn how to secure your Node.js GraphQL API against introspection leaks, query bombing, batching attacks, resolver-level authZ bypasses, and injection via variables — with production-ready code and testing tools.

2026-07-14Read more →

Node.jsNext.jsSSRFAPI SecurityServer ComponentsOWASP Top 10Backend SecurityNetwork Security

SSRF Prevention in Node.js and Next.js: Server-Side Request Forgery Defense Guide [2026]

Server-Side Request Forgery (SSRF) is one of the most dangerous vulnerabilities for modern full-stack applications. Here's how to prevent SSRF in Node.js backends, Next.js Server Components, API routes, and server actions — with practical code examples and a production-ready validation library.

2026-07-07Read more →

Node.jsOWASPExpressBackend SecuritySQL InjectionSecurity ChecklistAPI Security

OWASP Top 10 for Node.js Backends: A Practical Security Guide for 2026

The OWASP Top 10 mapped to Node.js and Express backends — with real code examples for each vulnerability, exploitation patterns, and concrete mitigations every Node.js team should have in their audit checklist.

2026-06-30Read more →

Node.jsNext.jsRate LimitingAPI SecurityDDoSBrute ForceRedis

API Rate Limiting and Brute Force Protection in Node.js and Next.js [2026]

Rate limiting is your first line of defense against brute force attacks, DDoS, and API abuse. Here's how to implement production-grade rate limiting in Node.js and Next.js using Express middleware, Next.js middleware, and Redis-backed sliding windows.

2026-06-23Read more →

ReactNext.jsCSPContent Security PolicyXSSWeb Security

Content Security Policy in React and Next.js: A Practical Guide to CSP with Nonces and strict-dynamic [2026]

Implementing a production-grade Content Security Policy for React and Next.js applications. Covers nonce-based CSP, strict-dynamic, reporting, eval management, and real-world deployment patterns for 2026.

2026-06-16Read more →

ReactNext.jsAuthenticationJWTSession ManagementCSRF

Auth & Session Management in React and Next.js: A Security-First Guide for 2026

JWT storage, CSRF protection, session hijacking prevention, and secure authentication patterns for React and Next.js applications. A practical guide for startups building production auth systems.

2026-06-09Read more →

ReactXSSSecurityCSPFrontend

XSS in React: What Every Developer Needs to Know in 2026

React's JSX protects against XSS by default, but dangerouslySetInnerHTML, SSR hydration, URL injection, and third-party scripts still leave applications vulnerable. Here's a complete guide to preventing XSS in React applications.

2026-06-02Read more →

Next.jsReactSecuritySSRFull-Stack

Next.js Security Best Practices: A Complete Guide for 2026

Next.js combines server and client rendering, creating unique attack surfaces. Learn how to secure your App Router app with CSP nonces, middleware guardrails, safe data fetching, and a full checklist.

2026-05-26Read more →

Node.jsnpmSecuritySupply ChainDependencies

npm Audit is Not Enough: Node.js Dependency Security in 2026

npm audit is a good start, but it won't protect your Node.js app from real-world supply chain attacks. Here's a complete dependency security strategy with Snyk, Semgrep, and OWASP Dependency-Check.

2026-05-21Read more →

ReactSecurityAuditOWASP

React Security Audit: A Complete Guide for Developers

Learn how to conduct a comprehensive React security audit. Covers XSS prevention, CSP headers, dependency security, OWASP Top 10, and more. Includes a practical checklist.

2026-05-19Read more →