PT-2025-37434 · Npm · Express-Xss-Sanitizer

Spendroslav · Published 2025-09-14 · Updated 2025-09-26 · CVE-2025-59364

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions express-xss-sanitizer versions through 2.0.0

Description The express-xss-sanitizer package contains an unbounded recursion depth in the sanitize function located in lib/sanitize.js when processing a JSON request body.

Recommendations Update to a version of express-xss-sanitizer greater than 2.0.0.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2025-59364

GHSA-HVQ2-WF92-J4F3

GHSA-QHWP-454G-2GV4

Affected Products

Express-Xss-Sanitizer

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-59364 · Security Note
• https://osv.dev/vulnerability/GHSA-hvq2-wf92-j4f3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59364 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qhwp-454g-2gv4 · Vendor Advisory
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-hvq2-wf92-j4f3 · Note
• https://github.com/AhmedAdelFahim/express-xss-sanitizer · Note
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/62d6542a2a57298da7a2e02de623454007e4f6d6 · Note
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/pull/23 · Note
• https://tenable.com/cve/CVE-2025-59364 · Note
• https://t.me/cveNotify/135420 · Telegram Post
• https://t.me/CVEtracker/32468 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-37434 · Note
• https://npmjs.com/package/express-xss-sanitizer · Note
• https://gist.github.com/Spendroslav/177804eaef5acfb222a550de212a1b94 · Note
• https://twitter.com/CVEnew/status/1967357802156106074 · Twitter Post