Dns Cache Poisoning in Express (Javascript)

DNS cache poisoning (also known as DNS spoofing) occurs when an attacker injects a malicious DNS record into a resolver’s cache, causing subsequent requests for a domain to return an attacker-controlled IP. In Express applications written in JavaScript, the risk arises when the server or its runtime environment performs hostname resolution—such as for service discovery, external API calls, or database connections—using potentially poisoned DNS results.

Express itself does not perform DNS resolution, but JavaScript-based code running in Node.js typically relies on the operating system’s or VM’s DNS caching behavior. When an Express app resolves hostnames via functions like dns.lookup(), dns.resolve(), or indirectly through HTTP clients (e.g., axios, node-fetch, or native http.request), the underlying system or Node.js internal cache may return a previously poisoned entry. This can redirect traffic to a malicious server, enabling man-in-the-middle (MITM) attacks, data exfiltration, or service disruption.

For example, consider an Express service that dynamically calls a payment gateway based on a hostname stored in configuration or retrieved from a remote source. If the hostname resolves to a poisoned IP, the application may unknowingly send sensitive transaction data to an attacker. In JavaScript, because hostnames are often handled as strings and resolution is asynchronous, developers may not enforce strict validation or freshness checks, increasing exposure. Attackers can exploit open DNS resolvers or use cache-snooping techniques to inject records with low TTL values, which Node.js or the OS may accept and cache.

middleBrick scans such unauthenticated attack surfaces in 5–15 seconds, identifying misconfigurations that may facilitate DNS poisoning indirectly—such as missing input validation on hostnames, improper use of external HTTP clients, or lack of certificate pinning when calling external services. The scan checks for insecure dependencies and unsafe consumption patterns that could amplify the impact of poisoned DNS entries, especially in microservice architectures where service names are resolved dynamically.

Using the middleBrick CLI (middlebrick scan <url>) or GitHub Action, teams can detect risky network behaviors before deployment. The Pro plan enables continuous monitoring for recurring exposure, while the MCP Server allows AI coding assistants to surface DNS-related risks during development.

Remediation focuses on minimizing reliance on external hostname resolution, validating all inputs, and enforcing strict transport security. Below are concrete JavaScript examples for Express that reduce the risk of DNS cache poisoning.

1. Avoid Dynamic Hostname Resolution

Do not construct URLs or pass untrusted strings directly to DNS-resolving functions. Instead, use static, vetted endpoints and hardcode IPs only when absolutely necessary (prefer CNAMEs or service discovery tools with integrity checks).

// Unsafe: using user-controlled input in DNS lookup
const dns = require('dns');
app.get('/proxy', (req, res) => {
  const targetHost = req.query.host; // attacker-controlled
  dns.lookup(targetHost, (err, address) => {
    if (err) return res.status(500).send('DNS error');
    // Potentially poisoned address used
  });
});

// Safe: use a fixed, validated endpoint
const SAFE_HOST = 'api.payment.example.com';
app.get('/payment', (req, res) => {
  // Use the safe host directly
  fetch(`https://${SAFE_HOST}/charge`)
    .then(r => r.json())
    .then(data => res.json(data));
});

2. Use Secure HTTP Clients with Explicit Configuration

Configure HTTP clients to reject insecure resolutions, enforce HTTPS, and avoid following redirects to untrusted hosts. Libraries like axios allow setting beforeRedirect and validating response hostnames.

const axios = require('axios');
const https = require('https');

// Safe: enforce HTTPS and validate host
const agent = new https.Agent({
  rejectUnauthorized: true,
});

app.get('/fetch', async (req, res) => {
  try {
    const response = await axios.get('https://api.service.example.com/data', {
      httpsAgent: agent,
      maxRedirects: 0, // avoid redirect to attacker-controlled host
      validateStatus: (status) => status >= 200 && status < 300,
    });
    res.json(response.data);
  } catch (err) {
    res.status(502).send('Secure fetch failed');
  }
});

3. Enforce Input Validation and Allowlisting

Treat all hostnames and domains as untrusted. Use allowlists and strict regex patterns to validate before any resolution. This prevents injection via query parameters or headers.

const validHosts = ['api.example.com', 'cdn.example.com'];
function isValidHost(host) {
  return validHosts.includes(host);
}

app.get('/resource', (req, res) => {
  const host = req.headers['x-api-host'];
  if (!host || !isValidHost(host)) {
    return res.status(400).send('Invalid host');
  }
  // Proceed with safe host
  fetch(`https://${host}/data`)
    .then(r => r.json())
    .then(data => res.json(data));
});

4. Leverage middleBrick for Continuous Detection

Integrate the middleBrick CLI or GitHub Action to automatically scan your Express endpoints for risky patterns, such as unsanitized hostname usage or missing HTTPS enforcement. The dashboard tracks security scores over time, helping teams maintain posture against evolving threats like DNS cache poisoning.