CVE-2025-59364: Express XSS Sanitizer DoS Vulnerability

CVE-2025-59364 Overview

CVE-2025-59364 affects the express-xss-sanitizer package (also known as Express XSS Sanitizer) through version 2.0.0 for Node.js. The vulnerability resides in the sanitize function within lib/sanitize.js, which processes JSON request bodies without enforcing a recursion depth limit. An attacker can submit a deeply nested JSON payload to trigger a stack overflow and crash the Node.js process. The flaw is categorized as uncontrolled recursion [CWE-674] and enables remote denial-of-service against any Express application that uses the middleware to sanitize incoming request bodies.

Critical Impact
Unauthenticated remote attackers can crash Node.js Express servers by submitting a deeply nested JSON body, causing a stack overflow inside the sanitizer.

Affected Products

express-xss-sanitizer npm package versions through 2.0.0
Node.js applications using Express with this middleware for JSON body sanitization
Any deployment exposing an HTTP endpoint that accepts JSON parsed through the sanitizer

Discovery Timeline

2025-09-14 - CVE-2025-59364 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59364

Vulnerability Analysis

The express-xss-sanitizer middleware recursively walks JSON structures to strip potentially malicious HTML and script content from user input. The sanitize function in lib/sanitize.js traverses each object and array by calling itself on every child element without tracking or capping the recursion depth. When the input contains a deeply nested object or array, the JavaScript call stack grows until the Node.js engine throws a RangeError: Maximum call stack size exceeded, terminating the worker process.

Because the middleware runs before application-level handlers, the crash occurs before any business logic can validate or reject the payload. A single malformed request is sufficient to disrupt service availability.

Root Cause

The root cause is missing depth accounting in the recursive traversal implemented in lib/sanitize.js. The function relies on the language runtime's own stack limit as an implicit boundary, which is a classic instance of [CWE-674] Uncontrolled Recursion. No iterative fallback, depth counter, or input-size guard is present in the affected versions.

Attack Vector

The attack is fully remote and unauthenticated. An attacker sends an HTTP request to any endpoint protected by the sanitizer middleware with a Content-Type: application/json body containing a payload nested thousands of levels deep, such as an object where each value contains another object, or an array containing another array. When the middleware invokes sanitize on the parsed body, recursion exceeds the V8 stack limit and the Node.js process exits. Public proof-of-concept material is referenced in the GitHub Gist Code Sample linked from the advisory.

See the Express XSS Sanitizer repository and the NPM package page for source code and version information.

Detection Methods for CVE-2025-59364

Indicators of Compromise

Node.js process crashes accompanied by RangeError: Maximum call stack size exceeded referencing lib/sanitize.js in the stack trace
Sudden worker or container restarts correlated with inbound POST or PUT requests carrying large JSON bodies
Access logs showing requests with unusually deep JSON nesting or oversized Content-Length values targeting endpoints protected by the sanitizer

Detection Strategies

Inspect application dependency manifests (package.json, package-lock.json, yarn.lock) for express-xss-sanitizer at versions up to and including 2.0.0
Enable structured logging around Express middleware to capture uncaughtException events referencing the sanitizer
Deploy web application firewall (WAF) rules that inspect JSON bodies and reject payloads exceeding a configured nesting depth or size threshold

Monitoring Recommendations

Track Node.js process restart counts and unhandled exception metrics in your observability platform
Alert on repeated 5xx responses or connection resets from endpoints that accept JSON input
Correlate crash telemetry with source IP addresses to identify probing patterns consistent with denial-of-service attempts

How to Mitigate CVE-2025-59364

Immediate Actions Required

Audit all Node.js services for use of express-xss-sanitizer versions through 2.0.0 and prioritize patching internet-facing applications first
Add a body-size and depth-limiting middleware in front of the sanitizer, for example by validating parsed JSON depth before it reaches sanitize
Configure express.json({ limit: '100kb' }) or a similarly conservative limit to reduce the attack surface

Patch Information

Monitor the express-xss-sanitizer GitHub repository and the NPM package page for a fixed release above 2.0.0. Upgrade using npm install express-xss-sanitizer@latest once a patched version is published, and verify the fix by reviewing the diff to lib/sanitize.js for added depth-limit handling.

Workarounds

Replace the middleware with an alternative sanitizer that enforces iterative traversal or explicit depth limits until a patched release is available
Pre-validate incoming JSON with a schema validator such as ajv configured with a maximum object depth
Deploy an API gateway or reverse proxy rule that rejects JSON payloads exceeding a defined nesting depth before requests reach the Node.js application

bash

# Configuration example: reject deeply nested JSON before the sanitizer runs
# Add this middleware ahead of express-xss-sanitizer in your Express app
npm install express-xss-sanitizer@latest