{"id":"GHSA-27r3-jxmh-p828","revision":null,"records":[{"revision":"a0c42956c0f8444285ade45f62382549","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111181","aliases":[],"title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","state":0,"publishedAt":"2026-10-22T14:29:56.577+00:00","modifiedAt":"2026-10-22T19:00:31.729+00:00","affected":[{"ecosystem":"Vendor product","name":"body-parser","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"body-parser\",\n                    \"product\": \"body-parser\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.0.0\",\n                            \"lessThan\": \"2.4.0\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.0\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"1.20.9\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"1.20.9\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/body-parser\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111181","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111181","identifiers":["CVE-2026-111181"]},"retained":false,"historicalAffected":[]},{"revision":"213d4645f54346bebb2089459ceab079","observedAt":"2026-10-25T05:17:13.11+00:00","statement":{"source":"nvd","id":"CVE-2026-111181","aliases":[],"title":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a C…","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","state":0,"publishedAt":"2026-10-22T15:17:04.763+00:00","modifiedAt":"2026-10-22T19:17:35.797+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-248"],"productCriteria":[],"sourceDates":{"published":"2026-10-22T15:17:04.763","lastModified":"2026-10-22T19:17:35.797"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-111181","identifiers":["CVE-2026-111181"]},"retained":false,"historicalAffected":[]},{"revision":"a6a54760cd9e4964bd18ce6e815dac09","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-27r3-jxmh-p828","aliases":["CVE-2026-111181"],"title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"### Impact\n\nA single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.\n\n### Patches\n\nFixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.\n\n### Workarounds\n\nPass `inflate: false` to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.","state":0,"publishedAt":"2026-10-23T20:53:11+00:00","modifiedAt":"2026-10-23T21:00:06.1316137+00:00","affected":[{"ecosystem":"npm","name":"body-parser","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.4.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"body-parser","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.20.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","https://nvd.nist.gov/vuln/detail/CVE-2026-111181","https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser","https://github.com/expressjs/body-parser/releases/tag/1.20.9","https://github.com/expressjs/body-parser/releases/tag/v2.4.0"],"sourceUrl":"https://github.com/advisories/GHSA-27r3-jxmh-p828","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-27r3-jxmh-p828","identifiers":["GHSA-27r3-jxmh-p828","CVE-2026-111181"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T16:35:43.6571608+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T16:35:43.6571608+00:00","lastSuccessAt":"2026-10-26T16:35:43.8399553+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.8399578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-14383a698c18b438874095b6930bcf02ecadce9207ef5dd44a6c1228ba692ad7","complete":true,"records":414305,"lastAttemptAt":"2026-10-26T16:35:35.4423763+00:00","lastSuccessAt":"2026-10-26T16:35:35.378716+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:35.4423763+00:00","snapshotPublishedAt":"2026-10-26T16:28:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T15:37:42.3202578+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":3564,"expectedIdentifiers":13477},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T16:35:43.6571608+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T16:35:43.6571608+00:00","lastSuccessAt":"2026-10-26T16:35:43.8407408+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.8407411+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-476481f3ca6a44d581181416ef7b13ff","complete":false,"records":13416,"lastAttemptAt":"2026-10-26T16:35:45.8749502+00:00","lastSuccessAt":"2026-10-26T16:35:45.9733731+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:45.9733731+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T16:35:43.5022967+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.5022967+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T16:35:43.2712128+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.2712128+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-a393d8fe0ae8408f3e4cab413b76047090c8e4a3c0a186c79edf33c9a3d3af95","complete":true,"records":2995,"lastAttemptAt":"2026-10-26T16:35:43.6142851+00:00","lastSuccessAt":"2026-10-26T14:35:47.9640893+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.6142851+00:00","snapshotPublishedAt":"2026-10-26T14:18:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e462c1c8904fe18fc1ab10d13d0abcd333d928efa63a77a5731657497361d59c","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T16:35:43.3810397+00:00","lastSuccessAt":"2026-10-26T15:37:05.2219961+00:00","error":null,"lastVerifiedAt":"2026-10-26T16:35:43.3810397+00:00","snapshotPublishedAt":"2026-10-26T14:48:44+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}