Rule Definition
Using deprecated Node.js API could lead to security compliancy issues. The Buffer() function and new Buffer() constructor are deprecated due to API usability issues that can potentially lead to accidental security issues. As an alternative, use of the following methods of constructing Buffer objects is strongly recommended: Buffer.alloc(size[, fill[, encoding]]) - Create a Buffer with initialized memory. Buffer.allocUnsafe(size) - Create a Buffer with uninitialized memory. Buffer.allocUnsafeSlow(size) - Create a Buffer with uninitialized memory. Buffer.from(array) - Create a Buffer with a copy of array Buffer.from(arrayBuffer[, byteOffset[, length]]) - Create a Buffer that wraps the given arrayBuffer. Buffer.from(buffer) - Create a Buffer that copies buffer. Buffer.from(string[, encoding]) - Create a Buffer that copies string.

Remediation
Use Buffer.alloc(size[, fill[, encoding]]) - Create a Buffer with initialized memory. Buffer.allocUnsafe(size) - Create a Buffer with uninitialized memory. Buffer.allocUnsafeSlow(size) - Create a Buffer with uninitialized memory. Buffer.from(array) - Create a Buffer with a copy of array Buffer.from(arrayBuffer[, byteOffset[, length]]) - Create a Buffer that wraps the given arrayBuffer. Buffer.from(buffer) - Create a Buffer that copies buffer. Buffer.from(string[, encoding]) - Create a Buffer that copies string.

Violation Code Sample

var express = require('express');
var cookieParser = require('cookie-parser');
var escape = require('escape-html');
var serialize = require('node-serialize');

var app = express();

app.use(cookieParser())

app.get('/', function(req, res) {
    if (req.cookies.profile) {
        var str = new Buffer(req.cookies.profile, 'base64').toString();
        var obj = serialize.unserialize(str);

        if (obj.username) {
            res.send("Hello " + escape(obj.username));
        }
    } else {
        res.cookie('profile', "eyJ1c2VybmFtZSI6ImFqaW4iLCJjb3VudHJ5IjoiaW5kaWEiLCJjaXR5IjoiYmFuZ2Fsb3JlIn0=", {
            maxAge: 900000,
            httpOnly: true
        });

        res.send("Hello stranger");
    }
});

app.listen(3000);

Fixed Code Sample

var express = require('express');
var cookieParser = require('cookie-parser');
var escape = require('escape-html');
var serialize = require('node-serialize');

var app = express();

app.use(cookieParser())

app.get('/', function(req, res) {
    if (req.cookies.profile) {
        var str = Buffer.from(req.cookies.profile, 'base64').toString();
        var obj = serialize.unserialize(str);

        if (obj.username) {
            res.send("Hello " + escape(obj.username));
        }
    } else {
        res.cookie('profile', "eyJ1c2VybmFtZSI6ImFqaW4iLCJjb3VudHJ5IjoiaW5kaWEiLCJjaXR5IjoiYmFuZ2Fsb3JlIn0=", {
            maxAge: 900000,
            httpOnly: true
        });

        res.send("Hello stranger");
    }
});

app.listen(3000);

https://nodejs.org/fr/docs/guides/buffer-constructor-deprecation/