CVE-2025-59364
CVE-2025-59364
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a JSON request body.
CVSS 5.3 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
express xss sanitizer
- Versions
- 2.0.0: Affected (semver)
No fix published
express-xss-sanitizer npm
- Affected ranges
- SEMVER: < 2.0.1
Update to 2.0.1