body-parser vulnerable to denial of service via url encoding
CVE-2024-45590

7.5HIGH

Key Information:

Vendor

Expressjs

Status
Body-parser
Vendor
CVE Published:
10 September 2024

What is CVE-2024-45590?

The body-parser library, utilized in Node.js applications for handling incoming request bodies, presents a vulnerability when url encoding is enabled in versions prior to 1.20.3. Attackers may exploit this weakness by sending a high volume of specially crafted requests to the server, leading to potential service disruption and denial of service. This vulnerability underscores the necessity for developers to upgrade to version 1.20.3 or later to mitigate associated risks and strengthen application security. For further information on this issue and its resolution, refer to the official security advisory.

Affected Version(s)

body-parser < 1.20.3

References

https://github.com/expressjs/body-parser/security/advisor...
x_refsource_CONFIRM
https://github.com/expressjs/body-parser/commit/b2695c445...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-45590 : body-parser vulnerable to denial of service via url encoding