Executive brief
express-xss-sanitizer is a Node.js library used to remove malicious content from web request data. A flaw in its sanitizer function allows attackers to send deeply nested JSON payloads that trigger excessive recursion, causing the application to crash or become unresponsive, resulting in a denial of service for legitimate users.
Technical details
The vulnerability is an unbounded recursion flaw (CWE-674) in the sanitize function (lib/sanitize.js) of express-xss-sanitizer when processing JSON request bodies. A remote, unauthenticated attacker can send a deeply nested payload to any endpoint protected by this sanitizer, causing the Node.js process to exceed its call stack limit with the error "Maximum call stack size exceeded," leading to a denial of service. The issue affects all versions through 2.0.0; no patch has been released as of the advisory date.
Affected products
- Ahmed Adel Fahim express-xss-sanitizer through 2.0.0
Timeline
- 2025-09-15: disclosed
- 2025-09-26: other: Advisory withdrawn as duplicate of GHSA-hvq2-wf92-j4f3