Node.js and Express Middleware Vulnerability in body-parser by Express

CVE-2026-111181

What is CVE-2026-111181?

A vulnerability exists in the body-parser middleware used in Node.js and Express applications, where a single crafted request can cause the application to crash. This issue is triggered when a request with a Content-Encoding, such as gzip, is processed without proper error handling in the decompression stream. If the request contains a valid compressed frame followed by trailing bytes, it leads to an uncaught exception during decoding. All endpoints utilizing the body-parser for body parsing are susceptible, regardless of whether a matching route exists. To mitigate this issue, users are advised to upgrade to body-parser versions 2.4.0 or 1.20.9 and disable request-body inflation if immediate upgrading is not possible.

References