Node.js Security: Pentesting and Exploitation – Overview
Introduction to Node.js
Global Namespace Pollution
HTTP Parameter Pollution (HPP)
Remote Code Execution with eval()
Remote OS Command Execution
Attacks due to Untrusted user input
Regex DoS
Information Disclosure in Node.js Web Applications
Automated Code Review of Node.js Application with NodeJsScan