Skip to content
OpenAdvisories

Package · npm

express-xss-sanitizer

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2026-33979

    Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

    Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where res…

    AhmedAdelFahim express-xss-sanitizer express-xss-sanitizer npm
  • Medium 5.3
    CVE-2025-59364

    express-xss-sanitizer has an unbounded recursion depth

    The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a JSON request body.

    Express XSS Sanitizer project Express XSS Sanitizer express-xss-sanitizer npm
  • High 7.3
    CVE-2022-21169

    Prototype Pollution

    The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.

    express-xss-sanitizer npm