Overview
Unrestricted Resource Consumption vulnerabilities in Node.js (Express) allow attackers to exhaust CPU and memory by sending large, crafted requests or streaming data that the server processes without protective bounds. In production, this can lead to degraded performance, outages, and cascading failures as workers or containers reach memory caps or become saturated during peak load.
In Express apps, these issues often arise when payload parsing and request handling buffer inputs in memory without strict size controls, or when endpoints perform CPU-heavy work on untrusted data. Without rate limiting or timeouts, a small attacker payload can scale into a denial of service that affects many users.
Remediation patterns include enforcing strict input size limits at the middleware layer, using streaming approaches for large uploads, enabling per-request timeouts, and applying rate limiting. Architectural measures such as clustering, worker pools, and backpressure help prevent a single endpoint from exhausting resources.
Testing and validation should simulate large payloads, monitor memory/CPU during requests, and verify that timeouts and limits are enforced. Keep dependencies up to date and track CVEs as they are published; this guidance remains generic in the absence of specific CVEs in the prompt.
Code Fix Example
Node.js (Express) API Security Remediation
/* VULNERABLE */
const express = require('express');
const app = express();
// No limit on body size; payloads buffered in memory
app.use(express.json());
app.post('/data', (req, res) => {
// Simulate CPU-intensive processing of user input
const input = req.body;
// heavy computation that could scale with attacker input
res.send({ status: 'ok' });
});
/* FIX */
const express = require('express');
const app = express();
// Enforce payload size limits to prevent unbounded buffering
app.use(express.json({ limit: '100kb' }));
app.use(express.urlencoded({ limit: '100kb', extended: true }));
// Optional: set a per-request timeout
app.use((req, res, next) => {
req.setTimeout(30000); // 30 seconds
next();
});
app.post('/data', (req, res) => {
const input = req.body;
// Safe processing with bounded input
res.send({ status: 'ok' });
});