Node.js CLI security cheat sheets for the permission model, network and filesystem restrictions, eval hardening, and TLS/crypto settings.
Run Node with explicit access controls and safer defaults.
Run with restricted permissions and controlled file access.
node --permission --allow-fs-read=./config app.jsUseful for defense-in-depth in local, CI, and service environments.
node --permission --allow-fs-write=./tmp app.jsRestricts write access under the permission model.
Permit network access under the permission model.
node --permission --allow-net=api.example.com app.jsRecent Node versions expose network permissions as part of the permission model.
node --permission --allow-child-process app.jsNeeded when the program uses child_process under permission restrictions.
Block code generation from strings.
node --disallow-code-generation-from-strings app.jsUseful in security-sensitive environments to reduce reliance on eval-like behavior.
node --enable-fips app.jsRequires a compatible Node and OpenSSL build.