body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111181 · Microsoft / collected KEV context

GHSA-27r3-jxmh-p828

cve-program · CVE-2026-111181

• https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-111181

• https://cna.openjsf.org/security-advisories.html
• https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828

osv · GHSA-27r3-jxmh-p828

• https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
• https://nvd.nist.gov/vuln/detail/CVE-2026-111181
• https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7
• https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916
• https://cna.openjsf.org/security-advisories.html
• https://github.com/expressjs/body-parser
• https://github.com/expressjs/body-parser/releases/tag/1.20.9
• https://github.com/expressjs/body-parser/releases/tag/v2.4.0

No related operational record is retained in the current change model.