Collected research

Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability

Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V.N. Venkatakrishnan and Yinzhi Cao · yinzhicao.org

FAST scales JavaScript abstract interpretation with a bottom-up pass that resolves dynamic call edges and Promise chains per scope, and a top-down pass that interprets only statements the sink depends on, then solves the path constraints to generate a working exploit automatically. It found 242 zero-day taint-style bugs in NPM with 21 CVEs and scaled to 200,000-line applications.

Record

Researcher

Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V.N. Venkatakrishnan and Yinzhi Cao

Published by

yinzhicao.org

Format

Whitepaper

Topic

Server

In the archive

• Collected in the 2023 research round

Related sources

• Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability

Tags

• nodejs
• command-injection
• path-traversal
• rce
• javascript
• static-analysis
• tooling
• cve
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Mingqing Kang, Yichao Xu, Song Li, Rigel Gjomemo, Jianwei Hou, V.N. Venkatakrishnan and Yinzhi Cao, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.