Node.js / JavaScript security code review

When it applies

Reading Node/JS source (Express, Next.js, NestJS, a package). Language companion to code-review-methodology — the exact sinks and framework gotchas to grep and trace.

Sinks & patterns (grep, then trace to user input)

• Command exec: child_process.exec/execSync with user input (use execFile/spawn w/ arg array); template strings in commands.
• Code eval: eval, new Function, vm.runIn…, setTimeout("string") — RCE.
• Prototype pollution: recursive merge/Object.assign/lodash.merge/set, JSON.parse into object merges, query parsers — __proto__/constructor keys (→ web-prototype-pollution).
• SQL/NoSQL: string-built SQL; Mongo queries taking raw req.body/req.query (operator injection {$gt:''}); Sequelize .query()/literal.
• SSRF: axios/fetch/http.get/request on a user URL.
• Path/upload: fs.readFile/sendFile/path.join with user paths; res.sendFile traversal.
• XSS (server + client): res.send of unescaped input; DOM sinks innerHTML, document.write, dangerouslySetInnerHTML (React), v-html (Vue).
• Deserialization: node-serialize/funcster (unserialize RCE), untrusted JSON→object merge.