-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is caused by the use of express.json() without a size limit, which can lead to a Denial of Service attack. The commit 197d848e5450bf85b0dd19ef8c2aa4ba96192300 modifies the StartServer.listen function in index.js to add rate-limiting capabilities. This function is responsible for setting up the Express server. The line app.use(express.json()); within this function is the source of the vulnerability, as it lacks a limit option to restrict the size of incoming request bodies. While the patch adds a rate-limiter, it does not address the core issue of unlimited body size as recommended in the advisory's description. Therefore, StartServer.listen is identified as the vulnerable function because it contains the insecure configuration.
StartServer.listenindex.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| servify-express | npm | <= 1.1 |