{"action":"Upgrade node-body-parser to 2.3.0+~1.19.6-1 or later.","affected":[{"fixed":"2.3.0+~1.19.6-1","introduced":"0"}],"component":"node-body-parser","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.3.0+~1.19.6-1"],"id":"tcs_01M5NQERN8S0TN6QVE74B5GN2H","modified_at":"2026-10-01T03:02:23.384168708Z","published_at":"2026-07-09T11:16:24.670Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-12590","https://security-tracker.debian.org/tracker/CVE-2026-12590"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-12590#Debian:14/node-body-parser","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-12590"}],"summary":"Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse retu"}