
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
session-flash
Advanced tools
The flash is a special area of the session used for storing messages. Messages are written to the flash and cleared after being displayed to the user. The flash is typically used in combination with redirects, ensuring that the message is available to the next page that is to be rendered.
npm i session-flash
Flash messages are stored in the session. First, setup sessions as usual by
enabling cookieParser and session middleware. Then, use flash middleware
provided by session-flash.
const app = express();
const cookieParser = require('cookie-parser');
const session = require('express-session');
const flash = require('session-flash');
app.use(cookieParser());
app.use(session({
secret: 'session-secret',
resave: false,
saveUninitialized: false,
cookie: { maxAge: 60000 }
}));
app.use(flash());
With the flash middleware in place, all requests will have a req.flash() function
that can be used for flash messages.
app.get('/flash', function(req, res){
// Set a flash message by passing the key, followed by the value, to req.flash().
req.flash('info', 'Flash is back!')
res.redirect('/');
});
app.get('/', function(req, res){
// Get an array of flash messages by passing the key to req.flash()
res.render('index', { messages: req.flash('info') });
});
[The MIT License]
Copyright (c) 2012-2026
FAQs
Flash message middleware for Express sessions
We found that session-flash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.