# CVE-2026-33979: express-xss-sanitizer configuration bypass leads to permissive HTML sanitization

Source: https://junglewise.ai/threats/cve-2026-33979-ahmedadelfahim-express-xss-sanitizer-permissive-sanitization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33979 · Severity: low · CVSS 3.1 · Published 2026-03-27

Express XSS Sanitizer is a Node.js middleware that strips dangerous HTML from user input to prevent cross-site scripting attacks. A flaw in versions up to 2.0.1 causes developer-configured "allow nothing" rules to be ignored, reverting to lenient tag/attribute filtering instead. Depending on how applications use the sanitized output, attackers could inject malicious links, HTML content, or XSS payloads that bypass the developer's intended security policy.

Technologies: [express-xss-sanitizer (npm)](https://junglewise.ai/threats/technologies/express-xss-sanitizer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33979 being exploited in the wild.

**How severe is CVE-2026-33979?** Low severity, with a CVSS score of 3.1, published 27 March 2026.

**Which products and versions are affected?** express-xss-sanitizer (npm) SEMVER:introduced=0,fixed=2.0.2.

**Is there a fix for CVE-2026-33979?** Yes. express-xss-sanitizer (npm): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33979 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33979?** Check whether you run express-xss-sanitizer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- express-xss-sanitizer (npm): upgrade to 2.0.2 or later

  ```sh
  npm install express-xss-sanitizer@2.0.2
  ```


## Technical details

This is a configuration validation bypass vulnerability in express-xss-sanitizer's sanitize() function. The root cause lies in validation logic that checks for array/object length (allowedTags.length > 0 and Object.keys(allowedAttributes).length > 0), treating empty configurations as "not provided" rather than explicit directives. When developers pass empty arrays/objects to enforce strict stripping, the library silently falls back to sanitize-html's default permissive configuration, allowing tags like <a>, <p>, <div> and attributes like href. The vulnerability requires no authentication or user interaction—an attacker with control over user input and knowledge of the vulnerable configuration can inject HTML/XSS. The fix (v2.0.2) now correctly respects explicitly provided empty configurations and passes them directly to the underlying sanitize-html library without override.

## Affected products

- Ahmed Adel Fahim express-xss-sanitizer <= 2.0.1

## Identifiers

- CVE-2026-33979
- GHSA-3843-rr4g-m8jq

## Timeline

- 2026-03-25: disclosed
- 2026-03-25: patched: Patch released in v2.0.2

## References

- [https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq](https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq)
- [https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f](https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f)
- [https://github.com/AhmedAdelFahim/express-xss-sanitizer](https://github.com/AhmedAdelFahim/express-xss-sanitizer)
- [https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2](https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2)

## Related threats

- [express-xss-sanitizer unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-59364-express-xss-sanitizer-unbounded-recursion-denial-of-service)
- [express-xss-sanitizer unbounded recursion in sanitize function](https://junglewise.ai/threats/express-xss-sanitizer-unbounded-recursion-in-sanitize-function-e4c60884)
- [express-xss-sanitizer prototype pollution bypass in allowedTags](https://junglewise.ai/threats/cve-2022-21169-express-xss-sanitizer-prototype-pollution-bypass-in-allowedtags)