A team of researchers from Georgia Tech find a new attack technique that targets properties in Node.js and plan to publicly release a tool that has already identified 13 new vulnerabilities.

It’s so popular that it’s mostly used as the de facto web server framework for Node.js. Since Express is a minimalistic web framework, it doesn’t support any anti-CSRF measure by default (unlike ...

Fewer than a quarter of Node.js developers (23 percent) use any form of real-time protection against attacks.