NoSQL injection (ARCH3140)

Key typescript.security.nosql-injection · Severity error · Category security · CWE CWE-943

Passing untrusted objects straight into a NoSQL query allows operator injection such as $gt or $ne and authentication bypass. Always coerce input to primitive types.

Incorrect

app.post("/login", async (req, res) => {
  const user = await User.findOne({
    username: req.body.username,
    password: req.body.password,
  });
  res.json(user);
});

Correct

app.post("/login", async (req, res) => {
  const user = await User.findOne({
    username: String(req.body.username),
    password: String(req.body.password),
  });
  res.json(user);
});

Fix

Coerce query values to primitives (String/Number) or validate with a schema; never pass raw objects.