Unhandled Promise Rejection

Description

Detects promises that are created or called without proper rejection handlers. Unhandled promise rejections can cause application crashes, expose sensitive error information, and lead to inconsistent application state. In Node.js, unhandled promise rejections will terminate the process in future versions, making this a critical reliability and security issue.

What Shoulder detects

Promise at {location} lacks rejection handler (.catch or try-catch)

How to fix

Always handle promise rejections using one of these methods:

1. Use .catch() for promise chains
2. Use try-catch with async/await
3. Add global handlers for unhandled rejections

Example safe patterns:
```javascript
// ✅ SAFE - Using .catch()
fetch(url)
  .then(response => response.json())
  .then(data => processData(data))
  .catch(error => {
    logger.error('Fetch failed:', error);
    // Handle error appropriately
  });

// ✅ SAFE - Using async/await with try-catch
async function fetchData() {
  try {
    const response = await fetch(url);
    const data = await response.json();
    return processData(data);
  } catch (error) {
    logger.error('Fetch failed:', error);
    throw error; // Re-throw or handle
  }
}

// ✅ SAFE - Global handler (fallback)
process.on('unhandledRejection', (reason, promise) => {
  logger.error('Unhandled Rejection:', reason);
  // Optionally exit process for safety
  process.exit(1);
});
```

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

nodejs express fastify nextjs koa hapi nestjs

References

Documentation ↗ OWASP ↗ Learn about CWE-391

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-unhandled-promise-rejection .