CVE-2025-67731

CVE-2025-67731 describes a Denial of Service (DoS) vulnerability in the Servify Express Node.js package prior to version 1.2. The issue arises from the Express server's use of express.json() without a size limit, allowing attackers to send excessively large request bodies. This can lead to high memory consumption, performance degradation, or process crashes, impacting any application using an unconstrained JSON parser and exposed to untrusted clients. The vulnerability carries a CVSS score of 8.7 (HIGH), indicating a severe impact on availability (VA:H) with a low attack complexity (AC:L) and no user interaction required (UI:N). Attackers can exploit this remotely over the network (AV:N) without authentication (PR:N). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness at this time.