Executive brief
express-xss-sanitizer is a Node.js library used to prevent cross-site scripting (XSS) attacks by sanitizing user input. The library contains a flaw in its sanitization logic that fails to limit recursion depth when processing deeply nested objects, allowing attackers to crash the Node.js application by sending specially crafted requests with nested structures.
Technical details
The vulnerability exists in the sanitize function in lib/sanitize.js, which recursively processes nested objects without enforcing any depth limit (CWE-674: Uncontrolled Recursion). When an attacker sends a request containing deeply nested JSON objects, the recursive sanitization process consumes stack space until exhaustion, triggering a stack overflow and crashing the Node.js process. The attack requires only network access and no authentication or user interaction. Versions prior to 2.0.1 are affected; the patch introduces recursion depth limiting.
Affected products
- npm express-xss-sanitizer All versions prior to 2.0.1
Timeline
- 2025-09-26: disclosed
- 2025-09-26: patched: Version 2.0.1 released with recursion depth limiting