Room: Do Not Disturb (https://tryhackme.com/room/hh-donotdisturb-84a45644) Platform: TryHackMe Difficulty: Medium Category: Boot2Root /…

Most Node.js apps have an auth middleware. You write a protect function, drop it on your routes and call it done. That works fine until you…

Use this repository as a reference guide throughout your software development life cycle, whether you are releasing a new build, applying a…

The setup

Why authentication isn’t enough and where authorization actually belongs.

How browser geolocation, WebSockets, and an interactive map come together in one educational project

Three separate CVSS 10.0 sandbox escapes landed days apart — in a library that was declared dead once already

Building a REST API is only one part of exposing a service to consumers. Once an API is used by multiple applications or users, additional…

Building a Red vs Blue Cyber Range for Cookies Reuse and MFA Bypass A practical write-up on designing the attack story, building the lab, validating the result, and making the evidence visible. I …

Here’s a sentence that should sound impossible: sharing a link to a website could let someone run code on that website’s server. Not…

TL;DR: A path traversal vulnerability in the npm package image-downloader (< 4.3.1, ~38,000 downloads/month) lets an attacker write files…

Finding and Fixing Broken Access Control: A Case Study on Unauthenticated Admin Pages

An unexpected security incident in a Node.js project taught me why we should never blindly trust scripts loaded from external sources.

Not every file our upload endpoint accepts deserves the same treatment.

Build live chat, notifications, dashboards, tracking systems, collaborative features, and other real-time experiences using React, Node.js…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a …

CVE-2026–111497, Node.js’in bundle ettiği Brotli decoder’daki bir out-of-bounds write zafiyetidir. Node.js project bunu “remote code…

The October 2026 security release is a reminder that runtime upgrades must be rebuilt, redeployed, and verified across every production…

How an invalid block switch led to memory corruption, and what the patch changes.

Cybersecurity firm Aikido Security recently published an urgent advisory regarding an expanding decompression flaw. Initially tracked as Node2Shell (CVE-2026-111497), the threat now jeopardizes nu…