{"id":"EUVD-2025-202768","enisaUuid":"73839e31-fc15-3233-a9be-551533ab97b8","description":"Servify Express is a Node.js package to start an Express server and log the port it\u0027s running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes.","datePublished":"Dec 12, 2025, 7:40:53 AM","dateUpdated":"Dec 12, 2025, 8:44:17 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/Aarondoran/servify-express/security/advisories/GHSA-qgc4-8p88-4w7m\nhttps://github.com/Aarondoran/servify-express/commit/8dff7f56504b356278d849734ef2050e5cd23b61\nhttps://github.com/Aarondoran/servify-express/releases/tag/V1.2\n","aliases":"CVE-2025-67731\nGHSA-qgc4-8p88-4w7m\n","assigner":"GitHub_M","epss":0.4,"enisaIdProduct":[{"id":"93270ad3-c439-3d7f-953e-6753c2ffcd50","product":{"name":"servify-express","vendor":{"name":"Aarondoran"}},"product_version":"\u003c 1.2"}],"enisaIdVendor":[{"id":"288d6380-4c1d-3916-b30d-b0d5555c4f2f","vendor":{"name":"Aarondoran"}}],"enisaIdVulnerability":[{"id":"8ffbf3a9-b094-32f1-93f2-32aa8c3310cd","vulnerability":{"id":"GHSA-qgc4-8p88-4w7m","description":"Servify-express rate limit issue","datePublished":"Dec 11, 2025, 6:36:54 PM","dateUpdated":"Dec 12, 2025, 4:12:24 PM","baseScore":0.0,"references":"https://github.com/Aarondoran/servify-express/security/advisories/GHSA-qgc4-8p88-4w7m\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-67731\nhttps://github.com/Aarondoran/servify-express/commit/197d848e5450bf85b0dd19ef8c2aa4ba96192300\nhttps://github.com/Aarondoran/servify-express/commit/8dff7f56504b356278d849734ef2050e5cd23b61\nhttps://github.com/Aarondoran/servify-express\nhttps://github.com/Aarondoran/servify-express/releases/tag/V1.2\n","enisa_id":"EUVD-2025-202768\n","aliases":"CVE-2025-67731\nGHSA-qgc4-8p88-4w7m\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f7e57bc9-2e4f-33b4-b10e-d50e559f622b","vulnerability":{"id":"CVE-2025-67731","description":"Servify Express is a Node.js package to start an Express server and log the port it\u0027s running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes.","datePublished":"Dec 12, 2025, 7:40:53 AM","dateUpdated":"Dec 12, 2025, 8:44:17 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/Aarondoran/servify-express/security/advisories/GHSA-qgc4-8p88-4w7m\nhttps://github.com/Aarondoran/servify-express/commit/8dff7f56504b356278d849734ef2050e5cd23b61\nhttps://github.com/Aarondoran/servify-express/releases/tag/V1.2\n","enisa_id":"EUVD-2025-202768\n","assigner":"GitHub_M","epss":0.4,"dataProcessed":"Nov 2, 2026, 7:21:14 AM","vulnerabilityProduct":[{"id":"9f7b8862-bc39-361f-86e1-4a91cb6c336c","product":{"name":"servify-express","vendor":{"name":"Aarondoran"}},"product_version":"\u003c 1.2"}],"vulnerabilityVendor":[{"id":"92ea7932-48d6-30ee-9576-992b47af4a01","vendor":{"name":"Aarondoran"}}]}}],"enisaIdAdvisory":[]}