CVE-2025-67731

{"id": "CVE-2025-67731", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67731", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-12T20:43:59.650020Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Aarondoran", "product": "servify-express", "versions": [{"status": "affected", "version": "< 1.2"}]}]}], "published": "2025-12-12T08:15:48.367", "references": [{"url": "https://github.com/Aarondoran/servify-express/commit/8dff7f56504b356278d849734ef2050e5cd23b61", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Aarondoran/servify-express/releases/tag/V1.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Aarondoran/servify-express/security/advisories/GHSA-qgc4-8p88-4w7m", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without a size limit, which could allow attackers to send extremely large request bodies. This can cause excessive memory usage, degraded performance, or process crashes, resulting in a Denial of Service (DoS). Any application using the JSON parser without limits and exposed to untrusted clients is affected. The issue is not a flaw in Express itself, but in configuration. This issue is fixed in version 1.2. To work around, consider adding a limit option to the JSON parser, rate limiting at the application or reverse-proxy level, rejecting unusually large requests before parsing, or using a reverse proxy (such as NGINX) to enforce maximum request body sizes."}, {"lang": "es", "value": "Servify Express es un paquete de Node.js para iniciar un servidor Express y registrar el puerto en el que se est\u00e1 ejecutando. Antes de la versi\u00f3n 1.2, el servidor Express utilizaba express.json() sin un l\u00edmite de tama\u00f1o, lo que podr\u00eda permitir a los atacantes enviar cuerpos de solicitud extremadamente grandes. Esto puede causar un uso excesivo de memoria, un rendimiento degradado o fallos en el proceso, lo que resulta en una Denegaci\u00f3n de Servicio (DoS). Cualquier aplicaci\u00f3n que utilice el analizador JSON sin l\u00edmites y est\u00e9 expuesta a clientes no confiables se ve afectada. El problema no es una falla en Express en s\u00ed, sino en la configuraci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 1.2. Para solucionarlo, considere a\u00f1adir una opci\u00f3n de l\u00edmite al analizador JSON, limitar la tasa a nivel de aplicaci\u00f3n o de proxy inverso, rechazar solicitudes inusualmente grandes antes del an\u00e1lisis, o utilizar un proxy inverso (como NGINX) para aplicar tama\u00f1os m\u00e1ximos de cuerpo de solicitud."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:servify-express.js:servify_express:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "344861D6-7A4A-4E5A-8564-68A5E8DE0E01", "versionEndExcluding": "1.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}