Collected research

Mining Node.js Vulnerabilities via Object Dependence Graph and Query

Song Li, Mingqing Kang, Jianwei Hou and Yinzhi Cao · usenix.org

The Object Dependence Graph is a flow- and context-sensitive graph of JavaScript objects and their relations, built by abstract interpretation and queried the way a code property graph is, so one engine finds many Node.js bug classes instead of one. The ODGEN prototype models 13 of 16 vulnerability types and reported 180 zero-days, 70 of which received CVEs.

Record

Researcher

Song Li, Mingqing Kang, Jianwei Hou and Yinzhi Cao

Published by

usenix.org

Topic

Server

In the archive

• Collected in the 2022 research round

Related sources

• USENIX Security '22 - Mining Node.js Vulnerabilities via Object Dependence Graph and Query

Tags

• prototype-pollution
• command-injection
• static-analysis
• nodejs
• javascript-runtime
• tooling
• detection
• cve
• owasp-a03-2021
• owasp-a08-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Song Li, Mingqing Kang, Jianwei Hou and Yinzhi Cao, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.