Description

express-xss-sanitizer has an unbounded recursion depth

Security Advisory: express-xss-sanitizer

Overview

A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.

Affected Versions

All versions prior to 2.0.1

Patched Versions

2.0.1 and later

Description

The sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.

Impact

An attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.

Solution

Upgrade to version 2.0.1 or later:

npm install express-xss-sanitizer@latest

Mitigation

Aliases

References