| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| express-xss-sanitizer | < 2.0.1 | 2.0.1 |
A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.
The sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.
An attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.
Upgrade to version 2.0.1 or later:
npm install express-xss-sanitizer@latest
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí