Executive brief
Servify-express is a Node.js library that wraps Express to simplify server setup. The library's default configuration allows clients to send extremely large JSON request bodies without limits, causing the application to consume excessive memory and potentially crash, resulting in service outages. An attacker can exploit this by sending large requests to any exposed endpoint, disrupting service availability for legitimate users.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) stemming from misconfiguration of the Express JSON body parser. Servify-express initializes express.json() without setting a size limit parameter, allowing unbounded request body consumption. The attack is trivial to execute over the network with no authentication or user interaction required—an attacker simply sends oversized JSON payloads to any endpoint. This causes memory exhaustion and potential process crashes, resulting in denial of service. The issue was patched in version 1.2 by adding proper request size limits; users on versions ≤1.1 should upgrade or apply the documented workarounds (e.g., setting a limit in express.json() config or enforcing request size limits at the reverse-proxy level).
Affected products
- Aarondoran servify-express <=1.1
Timeline
- 2025-12-11: disclosed: Advisory published
- 2025-12-11: patched: Version 1.2 released with fix