Node.js Risk Assessment & Management 3 — Questions and Answers
Question 1: A Node.js application uses eval() to execute user-provided strings for a calculator feature. What is the main security risk?
- Increased parse time
- Arbitrary code execution in the server process (Correct answer)
- Larger bundle size
- Slower JSON serialization
Correct answer: Arbitrary code execution in the server process
eval() executes any JavaScript in the current process context, allowing an attacker to read environment variables, access the filesystem, or spawn processes.
Question 2: What is the risk of storing session tokens in URL query parameters in a Node.js web application?
- Tokens are too long for URL limits
- Tokens are logged in server access logs and browser history, enabling theft (Correct answer)
- Query params disable HTTPS
- Sessions expire faster
Correct answer: Tokens are logged in server access logs and browser history, enabling theft
URLs appear in server logs, Referer headers, and browser history, exposing session tokens to unintended parties.
Question 3: Which npm audit severity level should block a CI/CD pipeline deployment by default?
- info
- low
- moderate
- critical (Correct answer)
Correct answer: critical
Critical vulnerabilities have known exploits with high impact; blocking on critical ensures no actively dangerous dependency reaches production.
Question 4: A Node.js service receives a JWT and verifies it using jwt.verify(token, secret). What risk does omitting the algorithms option introduce?
- Slower verification throughput
- Algorithm confusion attacks, including the 'none' algorithm bypass (Correct answer)
- Automatic token expiration
- Larger token payload
Correct answer: Algorithm confusion attacks, including the 'none' algorithm bypass
Without restricting algorithms, an attacker can forge tokens signed with 'none' or switch from RS256 to HS256 using the public key as the HMAC secret.
Question 5: What risk is introduced when a Node.js app reads a file path constructed from user input without path normalization?
- File descriptor exhaustion
- Path traversal allowing access to files outside the intended directory (Correct answer)
- Encoding errors in file content
- Race condition on disk write
Correct answer: Path traversal allowing access to files outside the intended directory
Sequences like '../../../etc/passwd' let attackers escape the intended directory and read sensitive system files.
Question 6: Which Node.js mechanism helps limit the blast radius of a compromised third-party module by restricting its system access?
- The --experimental-vm-modules flag
- Node.js Permissions Model (--experimental-permission) (Correct answer)
- process.setuid()
- require.resolve() cache
Correct answer: Node.js Permissions Model (--experimental-permission)
The Permissions Model lets you restrict filesystem, child process, and worker thread access per process, reducing what a compromised module can reach.
Question 7: A Node.js Express app logs req.body directly to the console for debugging. What risk does this create in production?
- Increased latency from synchronous I/O
- Sensitive data like passwords or PII leaking into log aggregation systems (Correct answer)
- Event loop starvation
- CORS header misconfiguration
Correct answer: Sensitive data like passwords or PII leaking into log aggregation systems
Logging raw request bodies exposes credentials, PII, and tokens to log storage systems that may have broader access or weaker controls.
Node.js Risk Assessment & Management 3
A Node.js application uses eval() to execute user-provided strings for a calculator feature.
What is the main security risk?