body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

影響: npm:body-parser >= 2.0.0, < 2.4.0 → 2.4.0, npm:body-parser < 1.20.9 → 1.20.9

A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an unca…

Read on GitHub Advisory Database

On 10/24/2026, 05:53 AM, GitHub Advisory Database published "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-111181.