A password reset or login endpoint that responds differently depending on whether an account exists lets an attacker build a confirmed list of real users one request at a time.
Raising express.json's size limit at the application level so one endpoint can accept a large payload quietly gives every other route the same oversized limit, and with it a memory exhaustion risk.
Static file servers have no concept of a sensitive file, so a .env or .git directory that ends up inside the served folder gets delivered to anyone who requests it by name.
window.addEventListener('message', ...) delivers events from any frame on the page unless the handler checks event.origin, which makes an unchecked listener a trust boundary with no lock on it.
Production source maps map a minified bundle straight back to original file names, comments, and logic, and most bundlers generate them by default without deciding whether they should be publicly reachable.
Reading the client IP from X-Forwarded-For without validating it against a trusted proxy hop lets anyone bypass IP-based rate limits and allowlists by setting their own header.
Fetching a user-supplied URL server-side, a common pattern for webhooks and link previews, lets an attacker point your server at internal services and cloud metadata endpoints it was never meant to reach.
Leaving the default error-handling middleware in place means unhandled exceptions return full stack traces, file paths, and sometimes query parameters straight to whoever triggered them.
Setting Access-Control-Allow-Origin to a reflected wildcard while also allowing credentials defeats the same-origin protections CORS exists to enforce, and it is a common outcome of pasting together two Stack Overflow answers.