This DoS goes loop-di-loop – preventing DoS attacks in your Node.js application
summary
Node.js request handling blocks when heavy parsing or sync work runs on the event loop: raw JSON parsing scales linearly so large bodies tie up the server (limit sizes or offload to BFJ or JSONStream to run in worker threads), XML entity bombs expand tiny payloads to massive memory (7 levels: ~650 bytes → ~30MB; 8 levels → ~1GB) so disable entities or sanitize, catastrophic regex backtracking makes 33–35 A’s take minutes (use RE2 or vetted libs), and never use sync file IO — always async/fs promises.
AI-written summary · about
chapters (8)
- 0:00DoS attacks in Node.js
- 2:47Node.js event loop risks
- 6:19JSON parsing DoS
- 11:19XML bombs attack
- 16:50YAML bombs risks
- 17:57Regex backtracking DoS
- 23:59Blocking storage DoS
- 27:12Summary prevention
related talks
30mDo Not Thrash the Node.js Event Loop
42mThe Node.js Highway: Attacks Are At Full Throttle
41mPut on your asynchronous hat and node
21mFreezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
32mOptimize Your JSON Payload Efficiency x10 times
34mYou Don't Know Node.js
22mScaling Node.js and unblocking the Event Loop
47mNode.js Security: Breaking The Loop