CVE-2026-111181
HighCVSS 7.5Summary
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener; trailing bytes reach the already-finished decoder, which emits an error re-thrown as an uncaught exception that terminates the process. The issue is fixed in body-parser 2.4.0 and 1.20.9.
Risk Assessment
A single crafted request can terminate the Node.js process, causing a denial of service. Because body parsing runs before routing, any endpoint that parses a body is affected.
Recommendation
Upgrade body-parser to version 2.4.0 or 1.20.9 (or later). As a workaround, disable request-body inflation by setting the inflate option to false.
Other vulnerabilities in body-parser
See all- CVE-2026-12590Low
In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), an invalid limit option value (e.g., unparseable string or NaN) causes bytes.parse to return null, silently skipping the request body size check. Applications relying on limit as their primary safeguard against oversized requests will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.
- CVE-2025-13466Medium
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads with thousands of parameters within the default 100KB limit, causing elevated CPU and memory usage.
Original NVD description (English source)
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS