A Node.js App Behind nginx
Web apps and APIs written in JavaScript, such as a company's own web services or the back end of a single-page app.
Open It in the StackIts Layers
nginx takes the requests and passes them to a Node.js app. Much of the risk sits in its npm packages.
The stack runs from the top layer down, as on the topic page. Each layer shows its technology, and the badge beside it says who runs and patches it.
Who Runs What
You run every layer shown, from the app and nginx to Node.js and Linux, usually on your own server or a cloud virtual machine. In the cloud, the provider runs only what sits beneath Linux, which is the hypervisor and the hardware.
- You
- Your team runs it and installs its updates.
Where Its Code Comes From
Most of the app is npm packages, often hundreds of them, pulled in by the few the team chose. The server's software comes from the Linux distribution's packages, and a build pipeline puts the app together.
Well-Known Flaws in Its Layers
These are well-known flaws in the technologies this stack is built from. Each CVE id links to its advisory, and the technology's own page says how far that flaw reached.
CVE-2016-5195 (opens in a new tab)2016
Dirty COW, in Linux
A race condition in the Linux kernel let a local user gain root.