WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 • Aug 20, 2025 • Session details

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Are your TypeScript interfaces leaving your Node.js backend exposed? Discover how attackers bypass static compile-time checks and learn to implement strict runtime validation.

Pause
Mute Enter Fullscreen
#1 about 3 min

Context of npm vulnerabilities and TypeScript security assumptions

Introducing the false assumption that TypeScript provides embedded security guardrails during backend development.

#2 about 5 min

Analyzing HTTP parameter pollution and unexpected backend behaviors

How passing multiple types of parameters in HTTP requests creates unexpected and potentially vulnerable backend behavior.

#3 about 6 min

Bypassing type constraints using type juggling and array inputs

Why forcing type casting or relying on standard interfaces fails to protect against array-based type juggling.

#4 about 3 min

Understanding the limitations of compile-time TypeScript safety checks

Why development-time type checking must be combined with runtime techniques like type narrowing to prevent vulnerabilities.

#5 about 7 min

Exploiting Zod schema validation through prototype pollution attacks

How malicious actors inject prototype values to bypass runtime schemas and manipulate object inheritance in JavaScript.

#6 about 3 min

Bypassing database ORM safety mechanisms via unvalidated mass assignments

Why loosely parsed runtime schemas allow privilege escalation when passing objects directly into object-relational mappers.

#7 about 3 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Reviewing actual vulnerability disclosures in popular open-source libraries caused by unhandled type variations and prototype pollution.

#8 about 2 min

Rethinking application design and standard code type safety practices

Why software engineering teams must treat type definitions like code coverage instead of robust security protections.

Matching moments

2:00 min

The origins and early problems solved by TypeScript

Dani Coll Dani Coll · World Congress 2026 Europe

2:28 min

Exploring the benefits of type safety and TypeScript migration

Chris Heilmann +2 · LIVE

1:00 min

Misconceptions about TypeScript safety capabilities

Simone Sanfratello · JS Congress

4:58 min

Introduction to hidden problems in typical TypeScript code

Stefan Baumgartner · World Congress 2023

4:34 min

Discovering the hidden drawbacks of advanced type mitigations

Stefan Baumgartner · World Congress 2023

3:08 min

Introduction to basic TypeScript capabilities and type annotations

Jens Claes · World Congress 2023

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
11 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
about 1 year ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
about 1 year ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
about 1 year ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
about 1 year ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
about 1 year ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 24, 2026 · 11:40–12:10

Stage 2

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

September 24, 2026 · 16:00–18:00

Stage 11

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 4

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

September 24, 2026 · 16:10–16:40

Stage 7

Your Threat Model Is Lying to You: Why Modeling the Design Isn’t Enough in 2026

Farshad Abasi

CEO/Founder, Eureka DevSecOps + Forward Security

Farshad Abasi

Related videos

Lies we Tell Ourselves As Developers thumbnail
31:13
World Congress 2023 • about 3 years ago

Lies we Tell Ourselves As Developers

Stefan Baumgartner

Don't compromise on speedy delivery nor type-safety by choosing TypeScript thumbnail
29:44
World Congress 2023 • almost 3 years ago

Don't compromise on speedy delivery nor type-safety by choosing TypeScript

Jens Claes

End-to-End TypeScript: Completing the Modern Development Stack thumbnail
29:17
World Congress 2025 • about 1 year ago

End-to-End TypeScript: Completing the Modern Development Stack

Marco Podien

Typed Security: Preventing Vulnerabilities By Design thumbnail
58:19
LIVE • over 2 years ago

Typed Security: Preventing Vulnerabilities By Design

Michael Koppmann

Do TypeScript without TypeScript thumbnail
43:27
JS Congress • almost 5 years ago

Do TypeScript without TypeScript

Simone Sanfratello

Where we're going we don't need JavaScript - Programming with Type Annotations thumbnail
29:30
World Congress 2022 • about 4 years ago

Where we're going we don't need JavaScript - Programming with Type Annotations

Peter Kröner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.