Express.js Penetration Testing
Express only routes requests and chains middleware, with no built-in idea of who can do what. We test your middleware order, session and proxy settings, and where a route slips through unprotected. CREST-certified testers, fixed price from £2,850 for a 2-day single-framework scope, quoted within 24 hours.
- Unlimited retesting
- Unlimited pre-retesting
- No hidden fees
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Express runs every request through the middleware you register, in the order you register it, whether that is app-level or nested inside a router. We test whether the middleware a route depends on, authentication, ownership checks, session handling, actually sits ahead of it once every router is mounted.
Why Express security depends on where you put the middleware
Express describes an application as a series of middleware function calls executed one after another during the request-response cycle, and Express’s own guide to using middleware is explicit that each function only reaches the next one once it calls next(). An express.Router() instance behaves the same way inside its own scope, a self-contained mini-app whose middleware only runs for the routes mounted on it, so we test whether the middleware your application depends on, an authentication check, a role guard, a logging function, actually sits before every route in scope, at the app level and inside every router mounted beneath it.
express-session’s own documentation sets the session cookie’s default to path ‘/’, httpOnly true, secure false and no maxAge, leaves sameSite unset unless your application configures it, and states plainly that its default MemoryStore is not built for production because it leaks memory and does not scale past a single process. Express’s trust proxy setting compounds that: enabling it changes where req.ip and req.protocol are read from, taking the value from the X-Forwarded-For and X-Forwarded-Proto headers instead of the raw connection, so we test your session, cookie and trust proxy configuration together, since a secure cookie flag that depends on req.protocol only behaves correctly if trust proxy matches your actual network path.
Request parsing and error output follow the same pattern of being correct only where you have configured them. Express’s built-in json and urlencoded body parsers default to a 100kb request size limit, and Express 5 changes the default query parser from extended to simple and switches express.urlencoded’s own extended option to false, both closing off the nested, __proto__-style parsing that extended mode allows unless your application turns it back on. Express’s own error-handling guide confirms that the built-in handler writes err.stack into the response until NODE_ENV is set to production, so we test what your parsers actually accept, whether anything downstream merges that input into another object unsafely, and what an unhandled error actually returns.
SCOPE
What we pen test on an Express.js application
Middleware Mounting Order and Route Execution Sequence
Express describes an application as a series of middleware function calls executed one after another during the request-response cycle, and each function only reaches the request if you call next() to hand it on. An authentication or logging function added with app.use() after the routes it was meant to cover never runs for them, so we test whether the middleware your application depends on actually sits before every route in scope, not the routes it happened to be added ahead of.
Router-Level vs App-Level Middleware Scope
An express.Router() instance is what Express’s own routing guide calls a self-contained mini-app: middleware loaded on the router with router.use() only runs for requests that reach routes mounted on that router, never for routes defined directly on the main app or on a different router. We test every router in your application for the middleware it actually carries once mounted, rather than assuming a check applied at the app level reaches routes nested inside a sub-router, or the other way round.
Route-Level Authorisation and Object Ownership
Express is, by its own description, a routing and middleware framework with minimal functionality of its own, so it has no built-in concept of roles, ownership or permissions: every authorisation check is code your team wrote and wired into a specific place in the middleware chain. We test whether a check that correctly blocks one user from another user’s account on one route is applied consistently everywhere that resource is reachable, including newer routes that reuse the same handler pattern.
Session Secret, Cookie Flags and Store Configuration
express-session’s documentation sets the session cookie’s default to path ‘/’, httpOnly true, secure false and no maxAge, leaves the sameSite attribute unset unless configured, and states that its default MemoryStore is purposely not built for production because it leaks memory and does not scale past a single process. We test your actual secret, cookie flags and store against that default, since an application that never overrides secure, sameSite or the store is running with whatever Express and express-session shipped.
Trust Proxy, req.ip and Rate-Limit Bypass via X-Forwarded-For
Express’s guide to running behind a proxy explains that enabling trust proxy changes where req.ip, req.hostname and req.protocol come from, reading X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto instead of the raw socket, and warns that an inconsistent number of hops to the app can let a client set that value to whatever it wants. We test your trust proxy configuration against your actual network path, and whether any rate limiting or IP-based control you rely on can be bypassed by a forged X-Forwarded-For header.
Body Parser Limits and Payload Handling
Express’s built-in json and urlencoded body parsers, which wrap the body-parser module, accept a default limit of 100kb on request size and, when the extended option is enabled, hand URL-encoded bodies to the qs library for nested-object and array parsing rather than treating every value as a flat string. We test what your endpoints actually accept above and below that limit, and whether a parser configured for rich, nested payloads is exposed on routes that only ever needed simple key-value pairs.
Query String Parsing and Prototype Pollution
Express 5 changes its default query parser from extended to simple and makes express.urlencoded’s own extended option default to false, both of which stop query and form keys such as __proto__ or constructor from producing nested objects unless your application explicitly re-enables that parsing. We test whether your query and body parsing accepts that nested syntax, and whether anything downstream merges the parsed result into another object without guarding the keys that would let a request pollute its prototype.
Error Handling and Stack Trace Exposure (NODE_ENV)
Express’s own error-handling guide confirms that its built-in error handler writes err.stack into the response body, and only switches to the plain HTTP status message once NODE_ENV is set to production. We test what an unhandled error in your application actually returns, since a NODE_ENV left unset, or a custom error handler that forwards err.stack of its own accord, can hand an attacker file paths, package versions and query fragments a generic error page would not.
CORS Configuration
The cors middleware documented on Express’s own site lets the origin option reflect any request’s Origin header when set to true, accept a single domain, a list or a regular expression, or allow every origin with ‘*’, with a separate credentials option controlling whether Access-Control-Allow-Credentials is sent at all. We test whether your configuration reflects an origin it should not, and whether that reflected origin is combined with credentials in a way that lets a browser send authenticated requests from a site you never intended to trust.
Static File Serving and Path Traversal
The express.static middleware serves files relative to whichever root directory you give it, searching multiple static directories in the order you register them, and its default dotfiles setting of ‘ignore’ treats any dot-prefixed file or directory as though it does not exist rather than actively blocking access to it. We test what your static route actually exposes, including any dotfiles setting changed from that default and any request path that still resolves outside the intended root.
OUR PROCESS
Express.js Penetration Testing: From Scope to Attestation
Scope and Middleware Mapping
We agree the environments and routes in scope, and map every middleware function, its mount point and its order, at the application level and inside every router.
Session and Trust Configuration Review
We review your session, cookie and trust proxy settings against the values your application actually sets, not the defaults you assume are in place.
Manual Exploitation
A CREST-certified tester manually tests route authorisation, object ownership, input parsing and error handling, chaining findings across middleware boundaries where they compound.
Report and Retest
You receive a technical report with CVSS scores and reproduction steps, a walkthrough call, a free retest once fixes are deployed, and an attestation letter for your auditors.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Express pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are written so your team can reference the report against each framework without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Express.js Penetration Testing Pricing
Pricing depends on the number of roles, integrations and environments in scope. See our pricing page for how we quote.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 5 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote5 to 8 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quoteSECTORS
Sectors We Test Express For
Sector-specific scoping for regulated UK organisations.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Express.js Penetration Testing
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
What access do you need to test our Express application?
We need at least one authenticated account for every distinct role or permission level your application exposes, plus access to the environment you want tested, whether that is a staging deployment or production. Sight of your route list or an OpenAPI or Swagger definition, where one exists, speeds up mapping every endpoint and the middleware it depends on.
Will testing touch our live data?
We test whichever environment you give us access to. If that is production, we agree exclusions upfront, such as bulk writes, deletes or any outbound requests your application would normally trigger, and we do not run destructive tests against real customer records without that agreement in writing.
How long does an Express penetration test take?
A single Express application sits in our 2-day single-framework scope, with a report typically landing around 5 working days after kickoff. An application with a wider role matrix, multiple integrated services or a separate admin interface moves into a larger scope with more testing days.
Do you test how our middleware is actually wired, not just what the code contains?
Yes. We test the live request path, which middleware actually runs before each route once your application and every mounted router are put together, rather than reading the source and assuming a function added somewhere applies everywhere you intended it to.
Is our REST API in scope, or do you also test server-rendered pages?
Both, where they exist. An Express application that renders views with a template engine is tested the same way as a JSON API: for authorisation on each route, session handling, and how user input reaches a response, whichever form that response takes.
What is out of scope for a single-framework Express test?
Infrastructure-level issues in the underlying server, container platform or cloud configuration are out of scope for this test and covered by our cloud penetration testing service instead. A separate frontend single-page application consuming your Express API, such as a decoupled React or Vue app, is also scoped and quoted separately.
Do you need our source code?
No. Testing is black-box against the running application by default. A grey-box option, where we review the relevant middleware, route handlers and session configuration alongside testing, is available if you want faster or deeper coverage of specific findings.
Does Express have a customer penetration-testing policy we need to follow?
No. Express is open-source framework code that you install, configure and deploy yourself rather than a shared or hosted service, so there is no vendor notification process to follow before testing it. If your Express application runs on a shared cloud platform, container service or managed hosting provider, that provider’s own penetration-testing policy still applies, and we confirm its current terms with you during scoping.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Express.js application
Express only routes requests and chains middleware, with no built-in idea of who can do what. We test your middleware order, session and proxy settings, and where a route slips through unprotected. CREST-certified testers, fixed price from £2,850 for a 2-day single-framework scope, quoted within 24 hours.
