{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"node-body-parser","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NQERETZ4PNFZEX9M88VJHT","modified_at":"2026-10-01T03:02:23.384168708Z","published_at":"2026-07-09T11:16:24.670Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-12590","https://security-tracker.debian.org/tracker/CVE-2026-12590"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-12590","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-12590"}],"summary":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse retu"}