Tóm tắt nhanh
- CVE-2025-67731 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng servify express (servify-express.js), servify-express.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.40%, cao hơn 34.8% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 1.2 hoặc mới hơn.
Mô tả
Impact
The Express server uses express.json() without a size limit, which can allow attackers to send extremely large request bodies. This may lead to excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected.
Patches
This issue is not a flaw in Express itself but in configuration. Users should set a request-size limit when enabling the JSON body parser. For example:
app.use(express.json({ limit: "100kb" }));
Workarounds
Users can mitigate the issue without upgrading by:
- Adding a
limit option to the JSON parser
- Implementing rate limiting at the application or reverse-proxy level
- Rejecting unusually large requests before parsing
- Using a reverse proxy (such as NGINX) to enforce maximum request body sizes
Mô tả của NVD
Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí