How to Build a Secure Serverless Port Scanner in Node.js (and Prevent SSRF)

Every network engineer and systems developer needs to verify connection ports. Whether you're debugging why a remote database connection is failing, checking if an SSH daemon is running, or auditing active firewall rules, programmatically checking TCP ports is a core developer task.

However, writing a port scanner in Node.js comes with a massive, critical security risk: Server-Side Request Forgery (SSRF).

If you allow users to pass a host parameter directly into a network socket connection, an attacker can input localhost or local IPs (like 127.0.0.1 or 192.168.1.1) to map and scan your own server's internal networks, databases, and microservices.

Here is how to build a high-performance TCP port scanner in Node.js that runs in a serverless environment and is fully hardened against SSRF attacks.

1. The Core Port Scanner logic (TCP & Banner Grabbing)