By language
Security testing for Node.js applications and APIs.
Node.js powers high-throughput APIs and full-stack apps. Its dynamic nature and vast dependency tree make prototype pollution, SSRF, injection, and access-control flaws the recurring risks worth testing continuously.
Common Node.js pitfalls
Prototype pollution, SSRF from server-side fetch features, NoSQL and command injection, and unsafe deserialization appear frequently. Dependency risk (via npm) compounds them.
API and auth focus
Express/Nest APIs commonly ship with broken object-level authorization and weak JWT validation - test both across roles and tenants.
Key risks to test
FAQ
What are common Node.js security vulnerabilities?
Prototype pollution, SSRF, NoSQL/command injection, unsafe deserialization, and broken object-level authorization in Express/Nest APIs - often amplified by vulnerable npm dependencies.
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.