GitHub repository: wiziardry/node-api-goat
Description: A simple Node.js Express REST app with some OWASP vulnerabilities.