WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2025 • Aug 20, 2025 • Session details

Friend or Foe? TypeScript Security Fallacies

Liran Tal

Are your TypeScript interfaces leaving your Node.js backend exposed? Discover how attackers bypass static compile-time checks and learn to implement strict runtime validation.

Pause
Mute Enter Fullscreen
#1 about 3 min

Context of npm vulnerabilities and TypeScript security assumptions

Introducing the false assumption that TypeScript provides embedded security guardrails during backend development.

#2 about 5 min

Analyzing HTTP parameter pollution and unexpected backend behaviors

How passing multiple types of parameters in HTTP requests creates unexpected and potentially vulnerable backend behavior.

#3 about 6 min

Bypassing type constraints using type juggling and array inputs

Why forcing type casting or relying on standard interfaces fails to protect against array-based type juggling.

#4 about 3 min

Understanding the limitations of compile-time TypeScript safety checks

Why development-time type checking must be combined with runtime techniques like type narrowing to prevent vulnerabilities.

#5 about 7 min

Exploiting Zod schema validation through prototype pollution attacks

How malicious actors inject prototype values to bypass runtime schemas and manipulate object inheritance in JavaScript.

#6 about 3 min

Bypassing database ORM safety mechanisms via unvalidated mass assignments

Why loosely parsed runtime schemas allow privilege escalation when passing objects directly into object-relational mappers.

#7 about 3 min

Analyzing real-world structural vulnerabilities in popular npm dependency packages

Reviewing actual vulnerability disclosures in popular open-source libraries caused by unhandled type variations and prototype pollution.

#8 about 2 min

Rethinking application design and standard code type safety practices

Why software engineering teams must treat type definitions like code coverage instead of robust security protections.

Matching moments

2:49 min

Introduction to the speakers and the TypeScript problem

Michael Hladky +1 · LIVE

2:00 min

The origins and early problems solved by TypeScript

Dani Coll Dani Coll · World Congress 2026 Europe

2:28 min

Exploring the benefits of type safety and TypeScript migration

Chris Heilmann Chris Heilmann +2 · LIVE

1:00 min

Misconceptions about TypeScript safety capabilities

Simone Sanfratello · JS Congress

4:58 min

Introduction to hidden problems in typical TypeScript code

Stefan Baumgartner · World Congress 2023

4:34 min

Discovering the hidden drawbacks of advanced type mitigations

Stefan Baumgartner · World Congress 2023

More from World Congress 2025

GenAI Security: Navigating the Unseen Iceberg thumbnail
24:33
12 months ago

GenAI Security: Navigating the Unseen Iceberg

Maish Saidel-Keesing

Behind the Code: How Women Are Powering the Future of AI thumbnail
30:28
about 1 year ago

Behind the Code: How Women Are Powering the Future of AI

Alexandra Wudel, Laura Moritz, Madalina Florean

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise? thumbnail
28:12
about 1 year ago

The AI Hype Filter: What’s Real, What’s Investable, What’s Noise?

Justus Lumpe, Konstantin Vinogradov, Nils Eiteneyer, Stephan Wirris

AI in Leadership: How Technology is Reshaping Executive Roles thumbnail
28:19
about 1 year ago

AI in Leadership: How Technology is Reshaping Executive Roles

Bernd Datler, Jasmin Kaiser, Jeff Hausmann, Sonja Alvarez

The AI-Ready Stack: Rethinking the Engineering Org of the Future thumbnail
28:09
about 1 year ago

The AI-Ready Stack: Rethinking the Engineering Org of the Future

Alex Laubscher, Jan Oberhauser, Keno Dreßel, Mirko Novakovic

AI Sovereignty: What Does It Take? thumbnail
29:13
about 1 year ago

AI Sovereignty: What Does It Take?

Boris Hecker, Clemens Wasner, Robin Hermann, Sonja Alvarez

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

From Profiler to Production: Measuring What Actually Matters in React & React Native

  • Andrei Tazetdinov

    Dynatrace

    React Native Developer

Open session

How Google built a Consistent, Global Authorization System with Zanzibar (and you can too!)

  • Sohan Maheshwar

    AuthZed

    Lead Developer Advocate

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

Designing for Every Direction: Logical CSS for Global, Adaptive, and Effortlessly Reversible UIs

  • Vidhya Krishnamoorthy

    Morgan Stanley

    VP, Software Engineering Manager

Related videos

Lies we Tell Ourselves As Developers thumbnail
31:13
World Congress 2023 • about 3 years ago

Lies we Tell Ourselves As Developers

Stefan Baumgartner

Don't compromise on speedy delivery nor type-safety by choosing TypeScript thumbnail
29:44
World Congress 2023 • about 3 years ago

Don't compromise on speedy delivery nor type-safety by choosing TypeScript

Jens Claes

End-to-End TypeScript: Completing the Modern Development Stack thumbnail
29:17
World Congress 2025 • about 1 year ago

End-to-End TypeScript: Completing the Modern Development Stack

Marco Podien

Typed Security: Preventing Vulnerabilities By Design thumbnail
58:19
LIVE • over 2 years ago

Typed Security: Preventing Vulnerabilities By Design

Michael Koppmann

Do TypeScript without TypeScript thumbnail
43:27
JS Congress • almost 5 years ago

Do TypeScript without TypeScript

Simone Sanfratello

Where we're going we don't need JavaScript - Programming with Type Annotations thumbnail
29:30
World Congress 2022 • over 4 years ago

Where we're going we don't need JavaScript - Programming with Type Annotations

Peter Kröner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.