XSS in Ahmedadelfahim Express-xss-sanitizer
CVE-2026-33979
Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prio…
EPSS: 0.000 (5.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N.
Affected products
- Ahmedadelfahim Express-xss-sanitizer — versions < 2.0.2
Weakness classification (CWE)
References
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/security/advisories/GHSA-3843-rr4g-m8jq (x_refsource_CONFIRM)
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/commit/5623009ef11dcf095c163a38dea07b9cc22ad19f (x_refsource_MISC)
- https://github.com/AhmedAdelFahim/express-xss-sanitizer/releases/tag/v2.0.2 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-33979?
- CVE-2026-33979 is a high-severity vulnerability in Ahmedadelfahim Express-xss-sanitizer, classified under CWE-183. CVSS score: 8.2/10. Published 2026-03-27.
- How severe is CVE-2026-33979?
- High severity. CVSS v3 base score is 8.2 out of 10.