What’s Vulnerable › Vulnerabilities

CVE-2026-33979: Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-27 · updated 2026-06-17
• Weakness: CWE-79

Description

Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.

Affected products

• express-xss-sanitizer: before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: express-xss-sanitizer 2.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2
• https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq

Get alerted when CVE-2026-33979 or the next vulnerability affects your stack