GitHub Advisoryadvisory · npm

GHSA-qgc4-8p88-4w7m Servify-express rate limit issue

HIGH Published 2025-12-11 Modified 2025-12-12 Official page ↗
Aliases
CVE-2025-67731
Ecosystem
npm
Packages
servify-express
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-770
Reviewed
2025-12-11

Affected packages

• npm servify-express: < 1.2 → fixed in 1.2

Description

Impact The Express server uses `express.json()` without a size limit, which can allow attackers to send extremely large request bodies. This may lead to excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. Patches This issue is not a flaw in Express itself but in configuration. Users should set a request-size limit when enabling the JSON body parser. For example: `app.use(express.json({ limit: "100kb" }));` Workarounds Users can mitigate the issue without upgrading by: • Adding a `limit` option to the JSON parser • Implementing rate limiting at the application or reverse-proxy level • Rejecting unusually large requests before parsing • Using a reverse proxy (such as NGINX) to enforce maximum request body sizes

Related

Alias · CVE (1)

  • CVE-2025-67731 Servify Express is a Node.js package to start an Express server and log the port it's running on. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References