npmPackage

express-xss-sanitizer

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-33979High 8.2
Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Affected: fixed in 2.0.2.
Fixed in 2.0.2 (released Mar 25, 2026, 2 days before disclosure).
The latest release, 2.0.2, is not affected.
50% of express-xss-sanitizer downloads last week were affected versions (17.7K).
CVE-2025-59364Medium 5.3
The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in…
Affected: fixed in 2.0.1.
Fixed in 2.0.1 (released Sep 26, 2025, 12 days after disclosure).
The latest release, 2.0.2, is not affected.
28% of express-xss-sanitizer downloads last week were affected versions (9.7K).
CVE-2022-21169High 7.3
Prototype Pollution
Affected: fixed in 1.1.3.
Fixed in 1.1.3 (released Sep 20, 2022, 6 days before disclosure).
The latest release, 2.0.2, is not affected.
0.9% of express-xss-sanitizer downloads last week were affected versions (324).