CVE-2025-59364: express-xss-sanitizer has an unbounded recursion depth

The vulnerability lies in the sanitize function in lib/sanitize.js, which is responsible for cleaning user input. This function recursively processes nested objects and arrays. However, it lacks any mechanism to limit the recursion depth. An attacker can exploit this by sending a request with a deeply nested JSON body. When the middleware in index.js passes this malicious input to the prepareSanitize function, which in turn calls sanitize, the uncontrolled recursion leads to a stack overflow, causing the application to crash. This results in a Denial of Service (DoS) vulnerability. The provided gist and the source code of lib/sanitize.js clearly show the recursive nature of the sanitize function without any safeguards.