CVE-2026-33979: Express XSS Sanitizer XSS Vulnerability

CVE-2026-33979 Overview

Express XSS Sanitizer is a middleware for Express 4.x and 5.x applications that sanitizes user input data across req.body, req.query, req.headers, and req.params to prevent Cross-Site Scripting (XSS) attacks. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored, potentially allowing XSS payloads to pass through despite administrators believing strict sanitization rules are in place.

Critical Impact

Applications using Express XSS Sanitizer with custom restrictive configurations (empty allowedTags or allowedAttributes) may be vulnerable to XSS attacks as the middleware silently ignores these security-hardening configurations.

Affected Products

• Express XSS Sanitizer versions prior to 2.0.2
• Express 4.x applications using vulnerable express-xss-sanitizer versions
• Express 5.x applications using vulnerable express-xss-sanitizer versions

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33979 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33979

Vulnerability Analysis

This vulnerability represents a Missing Input Sanitization flaw (CWE-79) that undermines the security controls administrators attempt to implement. The core issue lies in how the Express XSS Sanitizer middleware processes configuration options passed by developers. When developers explicitly provide empty arrays for allowedTags or allowedAttributes to enforce maximum restriction on user input, the middleware's validation logic incorrectly overrides these settings with default values, effectively bypassing the intended strict sanitization.

The network-accessible attack vector means any user who can submit input to affected endpoints can potentially inject malicious scripts. The vulnerability primarily impacts data integrity, as XSS payloads can be used to modify page content, steal session tokens, or perform actions on behalf of authenticated users.

Root Cause

The root cause is improper handling of explicitly provided empty configuration arrays in the validation logic. Prior to version 2.0.2, the middleware treated empty arrays as falsy values and replaced them with default permissive configurations. This behavior contradicts the reasonable expectation that an empty allowedTags array should result in zero HTML tags being permitted in sanitized output.

The fix in version 2.0.2 updates the validation logic to properly distinguish between "not provided" and "explicitly provided as empty." When allowedTags or allowedAttributes are provided (even if empty), they are now passed directly to the underlying sanitize-html library without being overridden.

Attack Vector

The attack exploits the configuration bypass by submitting XSS payloads through any input vector processed by the middleware—including request bodies, query parameters, headers, and URL parameters. Since the middleware silently ignores restrictive configurations, attackers can inject script tags and event handlers that administrators believed were blocked.

An attacker could craft malicious input containing HTML tags and JavaScript code. When processed by an application that has configured express-xss-sanitizer with empty allowedTags (intending to strip all HTML), the input passes through unsanitized due to the configuration being silently overridden with defaults. The malicious payload then renders in the victim's browser, enabling script execution in the context of the vulnerable application.

Detection Methods for CVE-2026-33979

Indicators of Compromise

• Unexpected HTML tags appearing in stored or reflected user input that should have been stripped
• JavaScript execution in contexts where all scripts should have been sanitized
• User reports of suspicious pop-ups or unexpected behavior when viewing user-generated content
• Log entries showing HTML special characters that should have been encoded or removed

Detection Strategies

• Audit your package.json and package-lock.json for express-xss-sanitizer versions below 2.0.2
• Review application code for uses of express-xss-sanitizer with empty allowedTags or allowedAttributes arrays
• Implement web application firewall rules to detect common XSS patterns in input
• Deploy content security policies (CSP) to mitigate impact of successful XSS exploitation

Monitoring Recommendations

• Enable detailed logging for all user input processing through the sanitizer middleware
• Monitor for anomalous patterns in user-submitted data that may indicate XSS probing
• Implement automated dependency scanning in CI/CD pipelines to detect vulnerable package versions
• Set up alerts for CSP violation reports which may indicate XSS attempts

How to Mitigate CVE-2026-33979

Immediate Actions Required

• Upgrade express-xss-sanitizer to version 2.0.2 or later immediately
• Review all application endpoints that process user input through the sanitizer middleware
• Audit stored user-generated content for existing XSS payloads that may have bypassed sanitization
• Implement Content Security Policy headers as defense-in-depth against XSS exploitation

Patch Information

The vulnerability has been addressed in version 2.0.2 of express-xss-sanitizer. The fix ensures that explicitly provided empty configurations for allowedTags and allowedAttributes are respected and passed directly to the underlying sanitize-html library. Upgrade by running npm update express-xss-sanitizer or specifying "express-xss-sanitizer": "^2.0.2" in your package.json. For detailed technical information, see the GitHub Security Advisory GHSA-3843-rr4g-m8jq and Release Notes for v2.0.2.

Workarounds

• If immediate upgrade is not possible, implement additional server-side input validation before the sanitizer middleware
• Add a secondary sanitization layer using an alternative library with verified strict mode behavior
• Deploy strict Content Security Policy headers to block inline script execution
• Consider temporarily blocking or heavily restricting endpoints that accept rich user input until patched

# Upgrade express-xss-sanitizer to patched version
npm install express-xss-sanitizer@^2.0.2

# Verify installed version
npm list express-xss-sanitizer

# Audit for other vulnerable dependencies
npm audit