body-parser vulnerabilities

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener; trailing bytes reach the already-finished decoder, which emits an error re-thrown as an uncaught exception that terminates the process. The issue is fixed in body-parser 2.4.0 and 1.20.9.

In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), an invalid limit option value (e.g., unparseable string or NaN) causes bytes.parse to return null, silently skipping the request body size check. Applications relying on limit as their primary safeguard against oversized requests will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads with thousands of parameters within the default 100KB limit, causing elevated CPU and memory usage.