rules-nodejs

RISK: eval() executes arbitrary strings as code, a top RCE vector when any input is attacker-influenced. FIX: parse JSON with JSON.parse, resolve functions via a lookup table, or use a typed config loader.

RISK: accepting the 'none' JWT algorithm lets an attacker forge tokens without a signature (classic jsonwebtoken vuln, CVE-2015-9235 family still recurring). FIX: pin algorithms to ['RS256'] or ['HS256'] explicitly in jwt.verify and never include 'none'.

RISK: 'new Function(...)' is an eval-equivalent that compiles arbitrary strings into callable code, enabling RCE if inputs are tainted. FIX: replace with real functions or a safe expression library (expr-eval, jsep) with an allow-listed grammar.

RISK: node-serialize.unserialize() executes embedded IIFEs on deserialization — documented RCE (CVE-2017-5941) and the package is unmaintained. FIX: use JSON.parse for data, or a schema-validated format (zod, ajv) over a structured wire format.

RISK: setTimeout/setInterval with a string argument invokes the eval path internally (per MDN), turning any interpolated value into RCE. FIX: always pass a function reference or arrow function.

RISK: rejectUnauthorized:false disables TLS certificate validation, exposing traffic to trivial MITM and credential theft. FIX: fix the trust store (NODE_EXTRA_CA_CERTS or ca option with the specific CA), never disable verification.

RISK: the Node 'vm' module is explicitly NOT a security sandbox — attackers escape via 'this.constructor.constructor' and similar tricks (confirmed in Node docs and CVE-2023-30581). FIX: run untrusted code in a separate process with resource limits, or use isolated-vm / vm2-successors with threat modeling.

RISK: child_process.exec spawns a shell, so any interpolated value can break out into arbitrary commands (classic command injection). FIX: use execFile or spawn with an argv array and never pass user input as part of the command string.

RISK: CORS origin '*' combined with credentials:true is either rejected by browsers or, via misconfig, leaks authenticated responses to arbitrary sites. FIX: reflect a strict allow-list of origins and only set credentials:true for those exact origins.

RISK: require() with a concatenated/variable path can load attacker-chosen modules (including postinstall-backdoored packages from Shai-Hulud-style attacks). FIX: use a static require or a hard-coded switch on validated identifiers.

RISK: Node.js 18 reached EOL in April 2025 and earlier majors get no security fixes — January 2026 CVEs (e.g. CVE-2025-55131) are only patched on 20.x+. FIX: set engines.node to '>=20.19' (current LTS line) and upgrade CI/runtime images.

RISK: AWS/GitHub/OpenAI/Slack token patterns in source get scraped by bots within minutes of a push (Shai-Hulud 2025 campaign weaponized exactly this). FIX: move to env vars or a secrets manager, rotate the exposed key immediately, and add the pattern to your pre-commit scanner.

RISK: cookies without httpOnly are readable from client JS, so any XSS immediately steals the session. FIX: set { httpOnly: true, secure: true, sameSite: 'lax' } on every res.cookie call.

RISK: jwt.verify without an explicit algorithms option trusts the token header, enabling alg-confusion attacks (HS256 signed with the RSA public key). FIX: always pass { algorithms: ['RS256'] } (or your chosen alg) to jwt.verify.

RISK: Math.random is a predictable PRNG — using it for tokens/secrets lets attackers recover values from a few samples. FIX: use crypto.randomBytes(n).toString('hex') or crypto.randomUUID() for any security-sensitive value.

RISK: assigning to __proto__ mutates Object.prototype across the app, a documented path to auth bypass and RCE (e.g. CVE-2022-21824, Lodash CVE-2019-10744). FIX: use Object.create(null) maps, Map, or explicit property assignment with hasOwnProperty guards.

RISK: shelljs.exec runs through a real shell and has the same injection surface as child_process.exec (CVE-2022-0144 regressed this). FIX: use execFile/spawn with an argv array, or shelljs.exec only with static strings.

RISK: js-yaml v3 'load' used the DEFAULT schema which instantiates arbitrary tagged types (RCE); legacy code still calls it. FIX: pin js-yaml >=4 and pass { schema: FAILSAFE_SCHEMA } for untrusted input, or use yaml.load with explicit safe schema.