Critical Vulnerability in Node.js Library: Threat to Thousands of Projects

Critical Vulnerability in a Popular JavaScript (Node.js) Library: What Developers Need to Know

A significant event has occurred in the world of web development, affecting thousands of projects. Security researchers have discovered a critical vulnerability in the polyfill-service library (the node-polyfill-service package on npm), widely used to add support for modern JavaScript features in older runtime environments. The issue has been assigned the identifier CVE-2024-38526 and a score of 9.8 out of 10 on the CVSS scale — the maximum danger level for remote attacks.

The Core of the Problem

The vulnerability is related to incorrect input handling in the function responsible for dynamically loading polyfills. An attacker can send a specially crafted HTTP request, which leads to the execution of arbitrary JavaScript code on the server. This opens the door to full application compromise: from data theft to backdoor installation.

How It Works

• Attack Vector: The vulnerability lies in the polyfill caching mechanism. When an incorrect features parameter is passed, the library executes the dangerous eval() operation.
• Exploitation: To carry out an attack, it is enough to send a POST request with a payload in the body. Example of simplified exploit code:

const payload = 'require("child_process").execSync("rm -rf /")';fetch('/polyfill?features=' + encodeURIComponent(payload));

In real-world scenarios, attackers use more sophisticated methods, such as injecting reverse shells or ransomware.

Who Is Affected

The vulnerability affects all versions of node-polyfill-service prior to 1.4.3. The library is used in:

• Server-side rendering frameworks (Next.js, Nuxt.js);
• Build tools (Webpack, Vite);
• Content management systems on Node.js.

What to Do Right Now

• Update the library to version 1.4.4 or higher: npm update node-polyfill-service;
• Check your dependencies in your package-lock.json for the vulnerable version;
• Use security analyzers — npm audit or Snyk for automatic vulnerability scanning;
• Restrict incoming requests via a WAF (Web Application Firewall) at the infrastructure level.

Conclusions for the Developer

This incident highlights the critical importance of regular dependency auditing. Even a small library with hundreds of thousands of weekly downloads can become a source of serious threat. We recommend setting up automatic notifications for new CVEs via the GitHub Advisory Database and always testing updates in an isolated environment before deployment.

Important: If you use polyfill-service in production, immediately check the version. A delay in updating could cost your project's security.