WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 β€’ Aug 20, 2025 β€’ Session details

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Are your TypeScript interfaces leaving your Node.js backend exposed? Discover how attackers bypass static compile-time checks and learn to implement strict runtime validation.

Pause
Mute Enter Fullscreen
#1 about 3 min

Context of npm vulnerabilities and TypeScript security assumptions

Introducing the false assumption that TypeScript provides embedded security guardrails during backend development.

#2 about 5 min

Analyzing HTTP parameter pollution and unexpected backend behaviors

How passing multiple types of parameters in HTTP requests creates unexpected and potentially vulnerable backend behavior.

#3 about 6 min

Bypassing type constraints using type juggling and array inputs

Why forcing type casting or relying on standard interfaces fails to protect against array-based type juggling.

#4 about 3 min

Understanding the limitations of compile-time TypeScript safety checks

Why development-time type checking must be combined with runtime techniques like type narrowing to prevent vulnerabilities.

#5 about 7 min

Exploiting Zod schema validation through prototype pollution attacks

How malicious actors inject prototype values to bypass runtime schemas and manipulate object inheritance in JavaScript.

#6 about 3 min

Bypassing database ORM safety mechanisms via unvalidated mass assignments

Why loosely parsed runtime schemas allow privilege escalation when passing objects directly into object-relational mappers.

#7 about 3 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Reviewing actual vulnerability disclosures in popular open-source libraries caused by unhandled type variations and prototype pollution.

#8 about 2 min

Rethinking application design and standard code type safety practices

Why software engineering teams must treat type definitions like code coverage instead of robust security protections.

Matching moments

2:00 min

The origins and early problems solved by TypeScript

Dani Coll Dani Coll Β· WWC Europe 2026

2:28 min

Exploring the benefits of type safety and TypeScript migration

Chris Heilmann +2 Β· LIVE

1:00 min

Misconceptions about TypeScript safety capabilities

Simone Sanfratello Β· JS Congress

4:58 min

Introduction to hidden problems in typical TypeScript code

Stefan Baumgartner Β· WWC 2023

4:34 min

Discovering the hidden drawbacks of advanced type mitigations

Stefan Baumgartner Β· WWC 2023

3:08 min

Introduction to basic TypeScript capabilities and type annotations

Jens Claes Β· WWC 2023

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
10 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
12 months ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
12 months ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
12 months ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
12 months ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
12 months ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi

Related videos

Lies we Tell Ourselves As Developers thumbnail
31:13
WWC 2023 β€’ almost 3 years ago

Lies we Tell Ourselves As Developers

Stefan Baumgartner

Don't compromise on speedy delivery nor type-safety by choosing TypeScript thumbnail
29:44
WWC 2023 β€’ almost 3 years ago

Don't compromise on speedy delivery nor type-safety by choosing TypeScript

Jens Claes

End-to-End TypeScript: Completing the Modern Development Stack thumbnail
29:17
WWC 2025 β€’ 12 months ago

End-to-End TypeScript: Completing the Modern Development Stack

Marco Podien

Typed Security: Preventing Vulnerabilities By Design thumbnail
58:19
LIVE β€’ over 2 years ago

Typed Security: Preventing Vulnerabilities By Design

Michael Koppmann

Do TypeScript without TypeScript thumbnail
43:27
JS Congress β€’ over 4 years ago

Do TypeScript without TypeScript

Simone Sanfratello

Where we're going we don't need JavaScript - Programming with Type Annotations thumbnail
29:30
WWC 2022 β€’ about 4 years ago

Where we're going we don't need JavaScript - Programming with Type Annotations

Peter KrΓΆner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.