{"id":"ghsa-ghsa-27r3-jxmh-p828","seq":661328,"kind":"advisory","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","url":"https://github.com/advisories/GHSA-27r3-jxmh-p828","permalink":"https://vulnpulse.app/items/ghsa-ghsa-27r3-jxmh-p828","summary":"影響: npm:body-parser >= 2.0.0, < 2.4.0 → 2.4.0, npm:body-parser < 1.20.9 → 1.20.9\nA single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an unca…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-111181"],"tags":["GHSA-27r3-jxmh-p828","body-parser","body-parser"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:53:11.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}