CVE-2026-33979 Express XSS Sanitizer: allowedTags/allowedAttributes bypass leads to permissive sanitization (XSS risk)
Attackers can bypass XSS sanitization in Express applications by exploiting ignored restrictive configurations, potentially executing malicious scripts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33979?
CVE-2026-33979 is a high-severity cross-site scripting vulnerability in AhmedAdelFahim express-xss-sanitizer, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Express XSS Sanitizer is Express 4.x and 5.x middleware which sanitizes user input data (in req.body, req.query, req.headers and req.params) to prevent Cross Site Scripting (XSS) attack. A vulnerability has been identified in versions prior to 2.0.2 where restrictive sanitization configurations are silently ignored. In version 2.0.2, the validation logic has been updated to respect explicitly provided empty configurations. Now, if allowedTags or allowedAttributes are provided (even if empty), they are passed directly to sanitize-html without being overridden.
Which versions are affected by CVE-2026-33979?
2 open source packages ship an affected version, including express-xss-sanitizer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
express-xss-sanitizer npm | All versions | 2.0.2 |
express-xss-sanitizer npm | All versions | 2.0.2 |
Products include Express Xss Sanitizer Project Express Xss Sanitizer.
How do I fix CVE-2026-33979?
Upgrade express-xss-sanitizer to 2.0.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33979 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33979 exists.
Other vulnerabilities in AhmedAdelFahim express-xss-sanitizer
Sources
Also known as GHSA-3843-rr4g-m8jq.