Executive brief
Express XSS Sanitizer is a Node.js middleware that strips dangerous HTML from user input to prevent cross-site scripting attacks. A flaw in versions up to 2.0.1 causes developer-configured "allow nothing" rules to be ignored, reverting to lenient tag/attribute filtering instead. Depending on how applications use the sanitized output, attackers could inject malicious links, HTML content, or XSS payloads that bypass the developer's intended security policy.
Technical details
This is a configuration validation bypass vulnerability in express-xss-sanitizer's sanitize() function. The root cause lies in validation logic that checks for array/object length (allowedTags.length > 0 and Object.keys(allowedAttributes).length > 0), treating empty configurations as "not provided" rather than explicit directives. When developers pass empty arrays/objects to enforce strict stripping, the library silently falls back to sanitize-html's default permissive configuration, allowing tags like <a>, <p>, <div> and attributes like href. The vulnerability requires no authentication or user interaction—an attacker with control over user input and knowledge of the vulnerable configuration can inject HTML/XSS. The fix (v2.0.2) now correctly respects explicitly provided empty configurations and passes them directly to the underlying sanitize-html library without override.
Affected products
- Ahmed Adel Fahim express-xss-sanitizer <= 2.0.1
Timeline
- 2026-03-25: disclosed
- 2026-03-25: patched: Patch released in v2.0.2
References
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f
- https://github.com/AhmedAdelFahim/express-xss-sanitizer
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2