The Node.js ecosystem has become a critical platform for server-side applications, yet existing security tools still miss many real world vulnerabilities. In this talk, I will present two recent projects from my group that address this gap: Graph.js (PLDI’24) and Explode.js (PLDI’25).

Graph.js is a new static analysis tool for detecting injection and prototype pollution vulnerabilities in Node.js packages. It relies on a novel abstract domain that enables a carefully calibrated balance between precision and recall on real-world code, outperforming its competitor tools in the state-of-the-art benchmarks. Explode.js is the first tool to synthesise exploits for Node.js packages that require complex, multi-step call sequences. By combining static analysis with symbolic execution, Explode.js automatically generates non-trivial exploits that would otherwise require many hours of manual effort.

Applied to a large set of popular Node.js packages in the wild, Graph.js and Explode.js uncovered 93 previously unknown vulnerabilities, of which 7 were assigned CVEs.