GitHub Advisoryadvisory · npm
GHSA-qgc4-8p88-4w7m Servify-express rate limit issue
HIGH
Official page ↗
- Aliases
- CVE-2025-67731
- Ecosystem
- npm
- Packages
- servify-express
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-770
- Reviewed
- 2025-12-11
Affected packages
• npm servify-express: < 1.2 → fixed in 1.2
Description
Impact
The Express server uses `express.json()` without a size limit, which can allow attackers to send extremely large request bodies. This may lead to excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected.
Patches
This issue is not a flaw in Express itself but in configuration. Users should set a request-size limit when enabling the JSON body parser. For example:
`app.use(express.json({ limit: "100kb" }));`
Workarounds
Users can mitigate the issue without upgrading by:
• Adding a `limit` option to the JSON parser
• Implementing rate limiting at the application or reverse-proxy level
• Rejecting unusually large requests before parsing
• Using a reverse proxy (such as NGINX) to enforce maximum request body sizes
Related
Alias · CVE (1)
- CVE-2025-67731 Servify Express is a Node.js package to start an Express server and log the port it's running on. vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/Aarondoran/servify-express/security/advisories/GHSA-qgc4-8p88-4w7m web
- https://nvd.nist.gov/vuln/detail/CVE-2025-67731 advisory
- https://github.com/Aarondoran/servify-express/commit/197d848e5450bf85b0dd19ef8c2aa4ba96192300 web
- https://github.com/Aarondoran/servify-express/commit/8dff7f56504b356278d849734ef2050e5cd23b61 web
- https://github.com/Aarondoran/servify-express package
- https://github.com/Aarondoran/servify-express/releases/tag/V1.2 web