Disclosure summary
Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes.
Source-reported weakness categories
CWE-400
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
NIST National Vulnerability Database · NVD-CVE-2025-67731
Open original source · Updated Oct 07, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
| Vendor | Product / association | Version / bounds |
|---|---|---|
| servify-express.js | servify_express | * {"versionEndExcluding":"1.2"} |
Original records & references
- NIST NVD record
- CVE Program record
- github.com — Patch
- github.com — Product, Release Notes
- github.com — Mitigation, Vendor Advisory
PUBLISHED 2025-12-12T03:15:48-05:00
MODIFIED 2026-10-07T16:10:01-04:00
INGESTED 2026-10-08T12:35:47-04:00