CVE-2026-111181
1 advisory.
npm/body-parser CVE-2026-111181: high 7.5
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
Action: Upgrade body-parser to 1.20.9 (1.x) or 2.4.0 (2.x) or later.
npm i body-parser@2.4.0npm i body-parser@1.20.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.4.0 | - |
| 0 | 1.20.9 | - |
Fixed versions
| 2.4.0 | 1.20.9 |
Sources
- osv: GHSA-27r3-jxmh-p828
- https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
- https://nvd.nist.gov/vuln/detail/CVE-2026-111181
- https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7
- https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/body-parser
- https://github.com/expressjs/body-parser/releases/tag/1.20.9
- https://github.com/expressjs/body-parser/releases/tag/v2.4.0
CVE-2026-111181 · published · modified · JSON