BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback
Shoulder.dev

Understand what every change actually did to your system.
🟢
Node.js Security
125 rules
71 CWEs 23 critical

Node.js Security Vulnerabilities

Shoulder detects 125 security patterns specific to Node.js applications built with Node.js.

Framework Coverage

Express 80 rules Fastify 70 rules Nodejs 52 rules Nextjs 33 rules Koa 33 rules Nestjs 30 rules Hapi 26 rules Lambda 6 rules Serverless 6 rules Prisma 5 rules Trpc 5 rules Typeorm 5 rules Typescript 5 rules Graphql 4 rules All 3 rules Next 3 rules Angular 1 rules Tests 1 rules

Vulnerability Categories

CWE-20 7 rules
Improper Input Validation
CWE-200 5 rules
Exposure of Sensitive Information to an Unauthorized Actor
2 critical
CWE-704 5 rules
Incorrect Type Conversion or Cast
CWE-798 5 rules
Use of Hard-coded Credentials
2 critical
CWE-89 4 rules
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
4 critical
CWE-79 3 rules
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
1 critical
CWE-94 3 rules
Improper Control of Generation of Code ('Code Injection')
1 critical
CWE-285 3 rules
Improper Authorization
3 critical
CWE-639 3 rules
Authorization Bypass Through User-Controlled Key
1 critical
CWE-22 2 rules
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
1 critical
CWE-117 2 rules
Improper Output Neutralization for Logs
CWE-209 2 rules
Generation of Error Message Containing Sensitive Information
CWE-327 2 rules
Use of a Broken or Risky Cryptographic Algorithm
CWE-400 2 rules
Uncontrolled Resource Consumption
CWE-502 2 rules
Deserialization of Untrusted Data
1 critical
CWE-601 2 rules
URL Redirection to Untrusted Site ('Open Redirect')
CWE-770 2 rules
Allocation of Resources Without Limits or Throttling
CWE-915 2 rules
Improperly Controlled Modification of Dynamically-Determined Object Attributes
2 critical
CWE-918 2 rules
Server-Side Request Forgery (SSRF)
CWE-1104 2 rules
Use of Unmaintained Third Party Components
🟢

Scan your Node.js project

Run Shoulder CLI to find Node.js-specific vulnerabilities.

npx @shoulderdev/cli trust . All Node.js threats