VYPR
← All advisories
High severityNVD Advisory· Published Dec 12, 2025· Updated Dec 12, 2025

Servify Express does not enforce rate limiting when parsing JSON

CVE-2025-67731

Description

Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Servify Express <1.2 uses express.json() without a size limit, allowing attackers to cause DoS via oversized request bodies.

Vulnerability

Servify Express is a Node.js package that simplifies starting an Express server. Prior to version 1.2, the package invoked express.json() without specifying a limit option, meaning there was no restriction on the size of incoming JSON request bodies [1][3]. This configuration oversight means the server will attempt to parse arbitrarily large payloads, consuming excessive memory and CPU resources.

Exploitation

An attacker can exploit this by sending HTTP requests with extremely large JSON bodies to any endpoint that uses the default JSON parser. No authentication is required; the attack can be launched from any untrusted client that can reach the server [1]. The lack of built-in rate limiting in the default setup (rate limiting is optional and must be explicitly enabled) further lowers the barrier to a sustained DoS attack [2][4].

Impact

Successful exploitation leads to uncontrolled resource consumption (CWE-400), resulting in degraded server performance, excessive memory usage, or process crashes. This constitutes a Denial of Service (DoS) condition that can render the application unavailable to legitimate users [1][3].

Mitigation

The issue is fixed in version 1.2 of Servify Express [1]. Users should upgrade to the latest version. For those unable to upgrade, workarounds include adding a limit option to express.json() (e.g., { limit: "100kb" }), implementing rate limiting at the application or reverse-proxy level, rejecting large requests before parsing, or using a reverse proxy like NGINX to enforce maximum request body sizes [1][3].

References
  1. NVD - CVE-2025-67731
  2. GitHub - Aarondoran/servify-express: express package form easily starting the server
  3. Servify-express rate limit issue
  4. Enhance server with optional rate limiting · Aarondoran/servify-express@8dff7f5

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
servify-expressnpm
< 1.21.2

Affected products

1
  • Aarondoran/servify-expressv5
    Range: < 1.2

Patches

2
197d848e5450

Merge pull request #4 from Aarondoran/Rate-limiter-security-feature

https://github.com/Aarondoran/servify-expressAaron doranDec 11, 2025via ghsa
commit
1 file changed · +10 −4
  • index.js+10 −4 modified
    @@ -1,18 +1,24 @@
 const express = require("express");
+const rateLimit = require("express-rate-limit");
 
 class StartServer {
-    static listen(port) {
+    static listen(port, options = {}) {
         const app = express();
 
-        // Middleware (optional)
+        if (options.rateLimit) {
+            const limiter = rateLimit({
+                windowMs: options.rateLimit.windowMs || 60000,
+                max: options.rateLimit.max || 100
+            });
+            app.use(limiter);
+        }
+
         app.use(express.json());
 
-        // Default route (optional)
         app.get("/", (req, res) => {
             res.send("Server is running!");
         });
 
-        // Start the server and log the default message
         app.listen(port, () => {
             console.log(`Server is running on port ${port}`);
         });
8dff7f56504b

Enhance server with optional rate limiting

https://github.com/Aarondoran/servify-expressAaron doranDec 11, 2025via ghsa
commit
1 file changed · +10 −4
  • index.js+10 −4 modified
    @@ -1,18 +1,24 @@
 const express = require("express");
+const rateLimit = require("express-rate-limit");
 
 class StartServer {
-    static listen(port) {
+    static listen(port, options = {}) {
         const app = express();
 
-        // Middleware (optional)
+        if (options.rateLimit) {
+            const limiter = rateLimit({
+                windowMs: options.rateLimit.windowMs || 60000,
+                max: options.rateLimit.max || 100
+            });
+            app.use(limiter);
+        }
+
         app.use(express.json());
 
-        // Default route (optional)
         app.get("/", (req, res) => {
             res.send("Server is running!");
         });
 
-        // Start the server and log the default message
         app.listen(port, () => {
             console.log(`Server is running on port ${port}`);
         });

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.