Node.js Risk Assessment & Management 4

Question 1

What is the risk of using JSON.parse() on untrusted large input without size limits in a Node.js service?

Accepted Answer

Denial of service via memory exhaustion from enormous payloads

Answer

Parsing a multi-gigabyte JSON body allocates an equivalent in-memory object tree, potentially exhausting heap memory and crashing the process.

Question 2

Which practice reduces the risk of dependency confusion attacks when using private npm packages?

Accepted Answer

Scoping private packages with a namespace and configuring a private registry

Answer

Scoped packages (e.g., @company/pkg) paired with a private registry URL in .npmrc prevent npm from resolving them from the public registry.

Question 3

A Node.js app uses setTimeout() with a callback that throws an uncaught error. What is the operational risk?

Accepted Answer

The unhandled exception crashes the process if no uncaughtException handler is registered

Answer

Exceptions thrown inside async callbacks that escape to the event loop become uncaughtException events and terminate the process by default.

Question 4

What security risk arises from enabling CORS with Access-Control-Allow-Origin: * on a Node.js API that uses cookie-based authentication?

Accepted Answer

Misconfigured echo-origin CORS exposes the API to CSRF from any authenticated site

Answer

When servers echo the request Origin header instead of validating it, any website can make credentialed cross-origin requests, enabling CSRF-style data theft.

Question 5

What risk does running a Node.js production process as the root user introduce?

Accepted Answer

A code execution vulnerability grants the attacker full system access

Answer

Running as root means any RCE in the application or its dependencies can perform any OS operation, including installing malware or exfiltrating data.

Node.js Practice Test

Node.js Practice Test

Node.js Risk Assessment & Management 4