4vulnerabilities
- Critical0 (0.0%)
- High2 (50.0%)
- Medium0 (0.0%)
- Moderate1 (25.0%)
- Low1 (25.0%)
body-parser
Ecosystem: npm
Downloads: 668.98 Mln
- 0CriticalAffects 0 versions
- 2HighAffects 3 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 1LowAffects 2 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 1
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 1
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (4)
Known vulnerabilities affecting body-parser, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-27r3-jxmh-p828 | High | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is |
| GitHub (opens in a new tab) | |
| GHSA-v422-hmwv-36x6 | Low | body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. This issue affects applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first. ### Patches This issue is fixed in [body-pars |
| GitHub (opens in a new tab) | |
| GHSA-wqch-xfxh-vrr4 | Moderate | body-parser is vulnerable to denial of service when url encoding is used### Impact body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. ### Patches This issue is addressed in version 2.2.1. |
| GitHub (opens in a new tab) | |
| GHSA-qwcr-r2fm-qrc7 | High | body-parser vulnerable to denial of service when url encoding is enabled### Impact body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. ### Patches this issue is patched in 1.20.3 ### References |
| GitHub (opens in a new tab) |
- GHSA-27r3-jxmh-p828Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
>= 2.0.0, < 2.4.0< 1.20.9
### Impact A single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is
CVE: CVE-2026-111181
- GHSA-v422-hmwv-36x6Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
< 1.20.6>= 2.0.0, < 2.3.0
### Impact When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. This issue affects applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first. ### Patches This issue is fixed in [body-pars
CVE: CVE-2026-12590
- GHSA-wqch-xfxh-vrr4Moderatebody-parser is vulnerable to denial of service when url encoding is used
>= 2.2.0, < 2.2.1
### Impact body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. ### Patches This issue is addressed in version 2.2.1.
CVE: CVE-2025-13466
- GHSA-qwcr-r2fm-qrc7Highbody-parser vulnerable to denial of service when url encoding is enabled
< 1.20.3
### Impact body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. ### Patches this issue is patched in 1.20.3 ### References
CVE: CVE-2024-45590