Common Node.js security vulnerabilities in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the main risk of using unsanitized user input in Node.js?

Consider a Node.js app that directly uses user input in database queries without cleaning it. What is the main security risk?

A Cross-Site Scripting (XSS) attack

B Man-in-the-Middle (MitM) attack

C SQL Injection attack

D Denial of Service (DoS) attack

💡 Hint

Think about attacks that manipulate database commands.

Using unsanitized input in database queries can allow attackers to inject malicious SQL commands, known as SQL Injection.

❓ component_behavior

intermediate

What happens if you use eval() on user input in Node.js?

Given a Node.js server that runs eval(userInput), what is the likely security consequence?

A It can lead to remote code execution vulnerabilities

B It safely executes user code without risks

C It prevents injection attacks automatically

D It only runs code in a sandboxed environment

💡 Hint

Consider what eval() does with arbitrary code strings.

Using eval() on user input allows attackers to run any code on the server, causing remote code execution risks.

📝 Syntax

advanced

Which code snippet properly prevents prototype pollution in Node.js?

Prototype pollution happens when attackers modify object prototypes. Which snippet blocks this?

A obj['__proto__'] = value; // directly assign

B delete obj['constructor']; obj[key] = value;

C Object.assign(obj, userInput); // blindly assign

D if (key === '__proto__') throw new Error('Pollution attempt'); obj[key] = value;

💡 Hint

Check which option blocks dangerous keys before assignment.

Checking for '__proto__' and throwing an error prevents prototype pollution by blocking prototype modification.

🔧 Debug

advanced

Why does this Node.js code cause a denial of service (DoS)?

Examine the code below:

const http = require('http');
http.createServer((req, res) => {
  while(true) {}
  res.end('Hello');
}).listen(3000);

What is the problem?

Node.js

const http = require('http');
http.createServer((req, res) => {
  while(true) {}
  res.end('Hello');
}).listen(3000);

A The server leaks memory causing slowdowns

B The infinite loop blocks the event loop causing DoS

C The server crashes due to missing response headers

D The server responds with wrong content type

💡 Hint

Think about what an infinite loop does in Node.js single-threaded model.

The infinite loop blocks the event loop, preventing any other requests from being handled, causing denial of service.

❓ state_output

expert

What is the output of this Express.js middleware chain with a missing next() call?

Consider this Express.js code:

const express = require('express');
const app = express();

app.use((req, res, next) => {
  console.log('First middleware');
  // missing next()
});

app.use((req, res, next) => {
  console.log('Second middleware');
  res.send('Done');
});

app.listen(3000);

What happens when a request is made?

Node.js

const express = require('express');
const app = express();

app.use((req, res, next) => {
  console.log('First middleware');
  // missing next()
});

app.use((req, res, next) => {
  console.log('Second middleware');
  res.send('Done');
});

app.listen(3000);

A Only 'First middleware' logs; request hangs without response

B 'First middleware' and 'Second middleware' both log; response sent

C Only 'Second middleware' logs; response sent immediately

D Server crashes with an error about missing next()

💡 Hint

Think about what happens if next() is not called in middleware.

Without calling next(), the request does not proceed to the next middleware, so it hangs and no response is sent.