parseInt Without Radix

javascript.radix

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

JavaScript

Description

Reports parseInt(…) calls that omit the second radix argument. Without it the runtime infers a base from the string prefix — usually base 10, but "0x…" switches to base 16 and (in legacy engines) "0…" may switch to base 8.

Rationale

The inferred-radix rules differ between engines and ECMAScript versions; modern engines have stabilised on base 10 / 16 but older deployments behave differently.
Even when the rules are stable, the implicit base hides intent — readers can’t tell whether the developer meant decimal or trusted the prefix.
Numeric coercion (Number(x) or +x) is usually a better fit anyway, and it has clear semantics.

// Bad - implicit radix
const id = parseInt(req.query.id);
const port = parseInt("0080");      // legacy: 0o80 = 64

Remediation

Always pass the radix explicitly, or use Number(…) / +x for plain numeric coercion.

// Good
const id = parseInt(req.query.id, 10);
const port = Number("0080");

References

MDN — parseInt()