{"id":"CVE-2026-111181","kind":"vulnerability","aliases":["CVE-2026-111181","GHSA-27r3-jxmh-p828"],"related":[],"title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","summary":"body-parser, the Express middleware that reads request bodies, crashes the whole Node process when a request has a compressed body followed by trailing bytes. The attacker gets a denial of service with one unauthenticated HTTP request.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"body-parser","fixed":["2.4.0"],"affected":">= 2.0.0, < 2.4.0","ecosystem":"npm"},{"name":"body-parser","fixed":["1.20.9"],"affected":"< 1.20.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["api-servers","cwe-248","express","node","npm","package","self-hosted"],"not_affected_if":["body-parser-patched","default-config-not-used","no-request-body-parsing"],"how_to_check":"Run npm ls body-parser in each app and check for a version >= 2.0.0 and < 2.4.0, or < 1.20.9.\nIf the app is on Express, check the body-parser version its express dependency resolves to.","fix":"Upgrade body-parser to 2.4.0 (2.x line) or 1.20.9 (1.x line) and redeploy.\nWorkaround if upgrade is delayed: set inflate: false on the body-parser middleware, which rejects compressed request bodies.","status":"open","published_at":"2026-10-22T15:17:04+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","triaged_at":"2026-10-23T21:00:12+00:00","updated_at":"2026-10-23T21:57:31+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T21:00:12Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade body-parser to 2.4.0 (2.x line) or 1.20.9 (1.x line) and redeploy.\nWorkaround if upgrade is delayed: set inflate: false on the body-parser middleware, which rejects compressed request bodies.","reach":"internet","impact":"medium","summary":"body-parser, the Express middleware that reads request bodies, crashes the whole Node process when a request has a compressed body followed by trailing bytes. The attacker gets a denial of service with one unauthenticated HTTP request.","category":"package","who_cares":["express","node","npm","self-hosted","api-servers"],"confidence":0.85,"needs_auth":"no","worst_case":"Any single request crashes the Node process with uncaught exception.","analyst_note":"","how_to_check":"Run npm ls body-parser in each app and check for a version >= 2.0.0 and < 2.4.0, or < 1.20.9.\nIf the app is on Express, check the body-parser version its express dependency resolves to.\nUnknown whether a specific config check exists beyond inflate settings.","needs_analyst":false,"not_affected_if":["default-config-not-used","body-parser-patched","no-request-body-parsing"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000533,"input_tokens":3056,"output_tokens":454,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111181':19A,27A '-2026':18A,26A '-248':38B '1.20.9':98C,227C '2.0.0':103C '2.4.0':105C,225C '27r3':22A 'affect':216C 'alreadi':177C 'already-finish':176C 'api':35B 'api-serv':34B 'applic':112C,166C 'attack':73B 'bodi':2A,16A,47B,55B,67B,85C,88C,115C,132C,144C,203C,214C,223C,245C,250C 'body':29A,32A 'body-pars':1A,46B,84C,114C,131C,222C,249C 'body-parser':28A,31A 'byte':11A,71B,162C,172C 'carri':123C 'compress':14A,66B,157C 'content':126C 'content-encod':125C 'crash':56B,110C 'creat':266C 'cve':17A,25A 'cwe':37B 'decod':163C,179C 'decompress':138C,263C 'default':118C 'denial':6A,76B 'disabl':242C 'emit':181C 'encod':127C,257C 'endpoint':210C 'error':150C,183C 'except':192C 'express':39B,50B,94C 'fals':255C 'finish':178C 'fix':220C 'follow':68B,159C 'frame':158C 'get':74B 'ghsa':21A 'ghsa-27r3-jxmh-p828':20A 'gzip':130C 'host':45B 'http':82B 'inflat':246C,252C 'issu':218C 'jxmh':23A 'later':238C 'leav':145C 'listen':151C 'match':198C 'middlewar':51B,90C 'node':40B,59B 'node.js':92C 'normal':168C 'npm':41B 'one':80B,155C,233C 'option':119C,253C 'p828':24A 'packag':42B 'pars':89C,204C,212C 'parser':3A,30A,33A,48B,86C,116C,133C,224C,251C 'payload':153C 'pipe':134C 'process':60B,196C 're':187C 're-thrown':186C 'reach':174C 'read':53B,142C 'reject':260C 'request':15A,54B,63B,83B,108C,122C,244C,258C 'request-bodi':243C 'requir':201C 'respond':167C 'rout':199C,207C 'run':205C 'self':44B 'self-host':43B 'server':36B 'servic':8A,78B 'set':247C 'singl':107C 'stream':139C,147C,264C 'termin':194C 'thrown':188C 'trail':10A,70B,161C,171C 'unauthent':81B 'uncaught':191C 'upgrad':231C 'use':113C 'user':229C 'valid':156C 'version':96C,101C,236C 'via':9A 'vulner':4A 'whole':58B 'workaround':241C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T15:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-27r3-jxmh-p828","url":"https://github.com/advisories/GHSA-27r3-jxmh-p828","severity":"high","published_at":"2026-10-23T20:53:11+00:00","modified_at":"2026-10-23T20:53:12+00:00","first_seen_at":"2026-10-23T20:59:05+00:00","fetched_at":"2026-10-23T20:59:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-111181","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","severity":null,"published_at":"2026-10-22T15:17:04+00:00","modified_at":"2026-10-22T19:17:35+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}