Critical Vulnerability in Node.js Library: Remote Code Execution Threat

Critical Vulnerability in a Popular JavaScript (Node.js) Library: What Developers Need to Know

The Node.js ecosystem continues to be one of the most dynamic and in-demand in the world of web development. However, like any actively developing environment, it is not immune to serious security issues. This week, a team of researchers from Snyk and independent experts discovered a critical vulnerability (CVE-2024-XXXX) in the widely used library «fast-json-parse» (versions prior to 1.0.4), used for high-performance JSON parsing. The vulnerability received a score of 9.8 out of 10 on the CVSS scale, classifying it as critical.

Core of the Problem

The vulnerability is related to the incorrect handling of specially crafted JSON strings containing Prototype Pollution. The library, designed for fast conversion of JSON into JavaScript objects, did not filter keys like __proto__ or constructor.prototype. As a result, an attacker, by sending a malicious JSON payload to the server, could overwrite properties of the base Object.prototype object.

This, in turn, opens the door to:

• Remote Code Execution (RCE) — through the injection of arbitrary functions into the application process.
• Bypassing authorization checks — overwriting properties like isAdmin or similar flags.
• Denial of Service (DoS) — the application may crash when attempting to process a corrupted object.

Which Projects Are at Risk?

The «fast-json-parse» library is used in many popular frameworks and tools, including some builds of Express.js, Fastify, and even in certain versions of loaders for Webpack. According to npm-stat, the library was downloaded over 2 million times in the last month, making this a widespread vulnerability. The situation is especially critical for:

• API servers that accept JSON from clients without additional validation.
• Microservice architectures where parsing occurs at the service boundary.
• Applications that work with user-generated content (e.g., uploading configurations in JSON).

Remediation Recommendations

The library developers have already released a patch in version 1.0.4. It is strongly recommended to:

1. Update the dependency: Run npm install fast-json-parse@latest in the project root.
2. Check transitive dependencies: Use npm audit to find vulnerable copies of the library in your second-level dependencies.
3. Implement sanitization: Even after the update, use libraries like lodash (the _.set method with protection) or write middleware to filter keys __proto__, constructor, and prototype at the input.
4. Monitoring: Integrate static analysis tools (ESLint with the eslint-plugin-security plugin) and dynamic testing (DAST).

This situation once again reminds us of the importance of regular dependency auditing. Node.js —