Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33979 Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scr… https://www.cve.org/CVERecord?id=CVE-2026-33979
Post summary
The post announces CVE‑2026‑33979 concerning Express XSS Sanitizer but offers no details on exploitation, defenses, or confirmation of active attacks.
🟠 CVE-2026-33979 - High Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vu... https://www.thehackerwire.com/vulnerability/CVE-2026-33979/ https://t.co/XMpPKACgDz
Post summary
The tweet announces CVE-2026-33979, describing an Express middleware that may allow XSS by failing to sanitize user input, linking to an external article for details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | express_xss_sanitizer_project | express_xss_sanitizer | - | node.js | - |