input validation
2 articles with this tag
Insecure deserialization: the risk of letting external data choose the object type, and how to prevent it
The danger in deserialization is not that bad values arrive; it is that some formats let external data decide which type of object to construct. So the damage does not stop at corrupted data — OWASP lists denial of service, access control bypass and remote code execution. Two defenses: switch to a pure data format so nothing chooses types for you, and sign serialized messages so unsigned ones are never restored. And some mechanisms cannot be made safe by configuration at all; the only fix is not using them.
Prototype pollution in Node.js: what the runtime does not cover, and how to defend in your own code
Prototype pollution is what happens when a special key in external input reaches JavaScript's built-in prototypes, usually through a recursive merge. Two outcomes: properties you never set appear everywhere (breaking authorization and option checks), or built-in methods vanish and the app crashes somewhere unrelated. The part that matters most is ownership — Node.js states this is not a vulnerability in Node.js core, and that defenses belong at the application and dependency level. Waiting for an update will not fix it.