| Package | Affected versions | Patched versions |
|---|---|---|
| express-xss-sanitizer | < 2.0.1 | 2.0.1 |
A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.
The sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.
An attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.
Upgrade to version 2.0.1 or later:
npm install express-xss-sanitizer@latest
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free