# express-xss-sanitizer unbounded recursion in sanitize function

Source: https://junglewise.ai/threats/express-xss-sanitizer-unbounded-recursion-in-sanitize-function-e4c60884  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2025-09-15

express-xss-sanitizer is a Node.js library used to remove malicious content from web request data. A flaw in its sanitizer function allows attackers to send deeply nested JSON payloads that trigger excessive recursion, causing the application to crash or become unresponsive, resulting in a denial of service for legitimate users.

Technologies: [express-xss-sanitizer (npm)](https://junglewise.ai/threats/technologies/express-xss-sanitizer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 15 September 2025.

**Which products and versions are affected?** express-xss-sanitizer (npm) SEMVER:introduced=0,last_affected=2.0.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run express-xss-sanitizer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unbounded recursion flaw (CWE-674) in the sanitize function (lib/sanitize.js) of express-xss-sanitizer when processing JSON request bodies. A remote, unauthenticated attacker can send a deeply nested payload to any endpoint protected by this sanitizer, causing the Node.js process to exceed its call stack limit with the error "Maximum call stack size exceeded," leading to a denial of service. The issue affects all versions through 2.0.0; no patch has been released as of the advisory date.

## Affected products

- Ahmed Adel Fahim express-xss-sanitizer through 2.0.0

## Timeline

- 2025-09-15: disclosed
- 2025-09-26: other: Advisory withdrawn as duplicate of GHSA-hvq2-wf92-j4f3

## References

- [https://dbugs.ptsecurity.com/vulnerability/PT-2025-37434](https://dbugs.ptsecurity.com/vulnerability/PT-2025-37434)

## Related threats

- [express-xss-sanitizer configuration bypass leads to permissive HTML sanitization](https://junglewise.ai/threats/cve-2026-33979-ahmedadelfahim-express-xss-sanitizer-permissive-sanitization)
- [express-xss-sanitizer unbounded recursion denial of service](https://junglewise.ai/threats/cve-2025-59364-express-xss-sanitizer-unbounded-recursion-denial-of-service)
- [express-xss-sanitizer prototype pollution bypass in allowedTags](https://junglewise.ai/threats/cve-2022-21169-express-xss-sanitizer-prototype-pollution-bypass-in-allowedtags)