npm/express-xss-sanitizer CVE-2025-59364: medium 5.3, EPSS 0.45%

express-xss-sanitizer has an unbounded recursion depth

Action: Upgrade express-xss-sanitizer to 2.0.1 or later.

npm i express-xss-sanitizer@2.0.1

Affected

Fixed versions

Sources

• osv: GHSA-hvq2-wf92-j4f3
• nvd: CVE-2025-59364
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-hvq2-wf92-j4f3
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/pull/23
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/62d6542a2a57298da7a2e02de623454007e4f6d6
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-37434
• https://gist.github.com/Spendroslav/177804eaef5acfb222a550de212a1b94
• https://github.com/AhmedAdelFahim/express-xss-sanitizer
• https://www.npmjs.com/package/express-xss-sanitizer
• https://www.tenable.com/cve/CVE-2025-59364

CVE-2025-59364 · published 2025-09-26T14:38:13Z · modified 2025-09-26T14:57:09.094984Z · JSON