Awesome Nodejs Security

Promise based HTTP client for the browser and node.js

String validation

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

The Simple, Secure Framework Developers Trust

UAParser.js: The Essential Web Development Tool for User-Agent Detection. Detect Browsers, OS, Devices, Bots, Apps, AI Crawlers, and more. Run in Browser or Node

EventStream is like functional programming meets IO

finds publicly known security vulnerabilities in a website's frontend JavaScript libraries

safely install npm packages by auditing them pre-install stage

tools for sandboxing your dependency graph

Endo is a distributed secure JavaScript sandbox, based on SES

Lint an npm or yarn lockfile to analyze and detect security issues

Ebook - Become a Node.js developer - https://fraxken.github.io/ebook_nodejs/

ClamAV antivirus scanning for Node.js — scan file uploads with a single function call. Zero dependencies. Typed Symbol verdicts. Local or Docker/clamd.

A low overhead rate limiter for your routes

Brute-force protection middleware for express routes by rate limiting incoming requests

Important security headers for Fastify

JavaScript security CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project.

package that checks if your Node.js installation is vulnerable to known security vulnerabilities

JSON.parse() drop-in replacement with prototype poisoning protection

Self-hosted, invisible CAPTCHA that detects AI agents driving real browsers. GDPR, WCAG 2.2 AA, and EAA: no cookies, no third-party data sharing, and no visual or audio puzzle. With a false-positive budget enforced in CI. Proof of work, drop-in for Turnstile and reCAPTCHA.

Enforces SSL for Node.js ExpressJS projects

JSON.parse() drop-in replacement with prototype poisoning protection

ECMAScript extensions (with respect to upcoming ECMAScript features)

A fastify csrf plugin

CSRF crumb generation and validation for hapi

eslint-scope: ECMAScript scope analyzer

Detect Glassworm & trojan source attacks that employ unicode bidi attacks to inject malicious code

ESLint plugin to detect and stop Trojan Source attacks

A server-side TypeScript and JavaScript library immune to Regular Expression Denial of Service (ReDoS) attacks by using Rust and linear RegEx under the hood. Regolith has a linear worst case time complexity, compared to the default RegExp found in TypeScript and JavaScript, which has an exponential worst case.

Checks filenames to be committed against a library of filename rules to prevent sensitive files in Git

a hapi CSP plugin

Mitigate security concerns of Dependency Confusion supply chain security risks

An extensible, heuristic-based vulnerability scanning tool for installed npm packages

Fast and simple way to check any HTTP Headers

Tiny helper to protect against Prototype Pollution vulnerabilities in your application regardless if they introduced in your own code or in 3rd-party code

Tor detect middleware for express

Guarantee Node.js disclosed the CVEs after a Security Release