VNX-544: Missing Standardized Error Handling Mechanism

Field	Value
Rule ID	VNX-544
Severity	Low
SARIF level	note
Kind	sast
Languages	JavaScript / TypeScript
CWE	CWE-544
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	missing-standardized-error express error-handling cwe-544
Source	internal/sast/rules/vnx-544.rego

Overview

VNX-544 maps to CWE-544: Missing Standardized Error Handling Mechanism. Express handles an error that no middleware takes with its built-in handler, which returns the stack trace to the client whenever NODE_ENV is not production, and without one central handler each route improvises its own error responses.

The rule reports const app = express() (once, at that line) when the app is served or exported (app.listen, http.createServer(app), module.exports = app, export default app) and no JavaScript or TypeScript file in the project registers an error middleware: no four-argument (err, req, res, next) function, typed or not, no errorHandler/handleErrors-style function passed to app.use, and no errorhandler() package.

What Gets Flagged

const app = express();          // FLAGGED: no error middleware anywhere
app.get('/users/:id', async (req, res) => {
  res.json(await db.findUser(req.params.id));
});
app.listen(3000);

What Is Not Flagged

• An error middleware anywhere in the project, including in another file (app.use(errorHandler) with function errorHandler(err, req, res, next) in middleware/errors.js).
• express.Router() modules, test and example code, comments and string literals.

Python’s broad except: pass is reported by VNX-391, not here.

Remediation

Register one error middleware after all routes that logs the error and returns a generic response:

app.use((err, req, res, next) => {
  logger.error(err);
  res.status(err.status || 500).json({ error: 'internal error' });
});

References

• CWE-544: Missing Standardized Error Handling Mechanism
• Express: Error handling

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-544
// nosec vnx-544

Or record an ignore rule: vulnetix ignore add --rule vnx-544 --reason "...". See Suppressing findings.