## body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-111181
- 公開日時: 2026-10-23T20:53:11.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-27r3-jxmh-p828)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-27r3-jxmh-p828

影響: npm:body-parser >= 2.0.0, < 2.4.0 → 2.4.0, npm:body-parser < 1.20.9 → 1.20.9
A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an unca…