A runtime that runs JavaScript on the server and can serve HTTP itself.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- Framework
- Web Server
- RuntimeNode.js
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Node.js runs JavaScript on the server, outside the browser. It sits on the same layer as PHP as a rival, not above or below it. Its built-in HTTP module lets it take web requests itself, but it is still a runtime, not a web server, and it often sits behind nginx.
How to Spot It
These are signs that a system runs Node.js, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Common port
3000 (a convention, not a Node.js default)
If It Has a Flaw
A flaw in Node.js reaches every Node.js application on the host. Much of the real-world risk sits in the npm packages an application pulls in.
A flaw exposes what runs on it.
- Framework and Libraries
Express
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Node.js.
Stacks and Code
Node.js is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- A Node.js App Behind nginxA Containerised App on Kubernetes
- Its Code Comes From
npm