The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a JSON request body.

Affected: npm: express-xss-sanitizer

# Security Advisory: express-xss-sanitizer

## Overview A vulnerability was discovered in express-xss-sanitizer that allowed unbounded recursion depth during sanitization of nested objects.

## Affected Versions - All versions prior to 2.0.1

## Patched Versions - 2.0.1 and later

## Description The sanitize function in lib/sanitize.js performed recursive sanitization without depth limiting, making it vulnerable to stack overflow attacks via specially crafted deeply nested JSON objects.

## Impact An attacker could cause denial-of-service by sending a request with deeply nested structures, potentially crashing the Node.js process.

## Solution Upgrade to version 2.0.1 or later:

```bash npm install express-xss-sanitizer@latest ```