Node.js Risk Assessment & Management 4 — Questions and Answers
Question 1: What is the risk of using JSON.parse() on untrusted large input without size limits in a Node.js service?
- Silent data loss on parse failure
- Denial of service via memory exhaustion from enormous payloads (Correct answer)
- Prototype mutation on nested objects
- TLS certificate invalidation
Correct answer: Denial of service via memory exhaustion from enormous payloads
Parsing a multi-gigabyte JSON body allocates an equivalent in-memory object tree, potentially exhausting heap memory and crashing the process.
Question 2: Which practice reduces the risk of dependency confusion attacks when using private npm packages?
- Pinning all public packages to exact versions
- Scoping private packages with a namespace and configuring a private registry (Correct answer)
- Using yarn instead of npm
- Disabling the npm cache
Correct answer: Scoping private packages with a namespace and configuring a private registry
Scoped packages (e.g., @company/pkg) paired with a private registry URL in .npmrc prevent npm from resolving them from the public registry.
Question 3: A Node.js app uses setTimeout() with a callback that throws an uncaught error. What is the operational risk?
- The timer never fires again
- The unhandled exception crashes the process if no uncaughtException handler is registered (Correct answer)
- The event loop is permanently blocked
- The timer queue overflows
Correct answer: The unhandled exception crashes the process if no uncaughtException handler is registered
Exceptions thrown inside async callbacks that escape to the event loop become uncaughtException events and terminate the process by default.
Question 4: What security risk arises from enabling CORS with Access-Control-Allow-Origin: * on a Node.js API that uses cookie-based authentication?
- Cookies are sent to all origins automatically
- Misconfigured echo-origin CORS exposes the API to CSRF from any authenticated site (Correct answer)
- TLS is disabled for cross-origin requests
- Sessions are shared between origins
Correct answer: Misconfigured echo-origin CORS exposes the API to CSRF from any authenticated site
When servers echo the request Origin header instead of validating it, any website can make credentialed cross-origin requests, enabling CSRF-style data theft.
Question 5: What risk does running a Node.js production process as the root user introduce?
- Higher memory usage
- A code execution vulnerability grants the attacker full system access (Correct answer)
- Slower event loop performance
- npm install requires sudo
Correct answer: A code execution vulnerability grants the attacker full system access
Running as root means any RCE in the application or its dependencies can perform any OS operation, including installing malware or exfiltrating data.
Question 6: Which tool in the Node.js ecosystem is specifically designed to identify known vulnerabilities in installed dependencies?
- npm dedupe
- npm audit (Correct answer)
- npm prune
- npm shrinkwrap
Correct answer: npm audit
npm audit queries the npm security advisory database and reports packages with CVEs, along with recommended remediation paths.
Question 7: A Node.js stream pipeline processes compressed user uploads. What denial-of-service risk must be mitigated?
- Backpressure causing write stalls
- Zip bombs: tiny compressed input expanding to gigabytes, exhausting memory (Correct answer)
- Stream cipher key reuse
- Non-UTF-8 encoding crashes
Correct answer: Zip bombs: tiny compressed input expanding to gigabytes, exhausting memory
Highly compressed payloads (zip bombs) can decompress to sizes many orders of magnitude larger, overwhelming available RAM and crashing the process.
Node.js Risk Assessment & Management 4
What is the risk of using JSON.parse() on untrusted large input without size limits in a Node.js service?