
Security News
Next.js Patches Critical Middleware Vulnerability (CVE-2025-29927)
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
The purpose with this module is to share contexts across async (and sync) calls. Contexts are accessed by keys and can be nested. It is an alternative to the deprecated domain. It is based on async_hooks that were introduced in node 8. Beware that that the async_hooks are still experimental in nodejs.
To avoid weird behavior with express
node-cls
in the first row of your app. Some popular packages use async which breaks CLS.body-parser
and context is getting lost, register it in express before you register node-cls
's middleware.Request handler
A typical scenario is when you need to share context in a request handler.
let http = require('http');
let cls = require('node-cls');
let server = http.createServer(function (request, response) {
let context = cls.create('request-context');
context.id = 1;
context.request = request;
context.response = response;
context.run(doWork);
})
server.listen(8080)
function doWork() {
let context = cls.get('request-context');
context.response.end(`End: ${context.id}`) //End: 1
}
Async calls
Context is retained in async calls.
let cls = require('node-cls');
let context = cls.create('myContext');
context.run(() => {
context.name = 'George';
setTimeout(onTimeout, 300);
});
function onTimeout() {
let context = cls.get('myContext');
console.log(context.name); //George
}
Nesting
Contexts can be nested, even on the same key.
let cls = require('node-cls');
let context = cls.create('myContext');
context.run(async () => {
context.name = 'George';
let context2 = cls.create('myContext');
await context2.run(onNested);
console.log(context.name) //George
});
async function onNested() {
await Promise.resolve();
let context = cls.get('myContext');
console.log(context.name); //undefined
context.name = 'John Nested';
setTimeout(onTimeout, 300);
}
function onTimeout() {
let context = cls.get('myContext');
console.log(context.name); //John Nested
}
Symbol as key
If you are a library author, use a Symbol as key to avoid conflicts with other libraries.
let cls = require('node-cls');
let key = Symbol();
let context = cls.create(key);
context.run(() => {
context.name = 'George';
setTimeout(onTimeout, 300);
});
function onTimeout() {
let context = cls.get(key);
console.log(context.name); //George
}
Await instead of run
In node 12 and above you can start a context directly instead of wrapping it in the run function. The start function returns a promise. You can leave the current context by calling exit.
let cls = require('node-cls');
async function main() {
let context = cls.create('myContext');
context.name = 'George';
await context.start();
let context2 = cls.create('myContext');
context2.name = 'John Nested';
await context2.start();
console.log(cls.get('myContext').name); //John Nested
cls.exit('myContext');
console.log(cls.get('myContext').name); //George
cls.exit('myContext');
console.log(cls.get('myContext')); //undefined
}
main();
FAQs
Continuation Local Storage based on async_hooks
The npm package node-cls receives a total of 5,190 weekly downloads. As such, node-cls popularity was classified as popular.
We found that node-cls demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Next.js has patched a critical vulnerability (CVE-2025-29927) that allowed attackers to bypass middleware-based authorization checks in self-hosted apps.
Security News
A survey of 500 cybersecurity pros reveals high pay isn't enough—lack of growth and flexibility is driving attrition and risking organizational security.
Product
Socket, the leader in open source security, is now available on Google Cloud Marketplace for simplified procurement and enhanced protection against supply chain attacks.