The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/sanitize.js for a JSON request body.
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.