p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de body-parser

Vulnerabilidades publicadas para body-parser en los últimos 30 días: 1. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 4

  1. CVE-2026-111181

    Alta · CVSS 7.5EPSS 0,37%Corrección disponible

    body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

    body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates th

    body-parser body-parserNode.js
    • Actualiza a 1.20.9
    • Actualiza a 2.4.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-12590

    Baja · CVSS 3.7EPSS 0,41%Corrección disponible

    body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

    Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, wh

    body-parser body-parserNode.js
    • Actualiza a 1.20.6
    • Actualiza a 2.3.0
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2025-13466

    Media · CVSS 5.5EPSS 0,36%Corrección disponible

    body-parser vulnerable to denial of service when url encoding is used

    body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic. This issue is addressed in version 2.2.1.

    body-parserNode.js
    • Actualiza a 2.2.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2024-45590

    Alta · CVSS 7.5EPSS 0,82%Corrección disponible

    body-parser vulnerable to denial of service when url encoding is enabled

    body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

    body-parserNode.js
    • Actualiza a 1.20.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →