body-parser: single unauthenticated request crashes Node apps via trailing bytes after gzip body (CVE-2026-111181)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-111181
A high-severity DoS vulnerability (CVE-2026-111181, GHSA-27r3-jxmh-p828) in the ubiquitous body-parser middleware lets any unauthenticated client crash a Node.js process with a single crafted request. When a request carries Content-Encoding (e.g. gzip), body-parser pipes it into a decompression stream and leaves it piped with no error listener after the body is read; a valid compressed frame followed by trailing bytes triggers an error on the finished decoder that is re-thrown as an uncaught exception, terminating the process. Parsing runs before routing, so no matching route or authentication is needed. Affects body-parser =2.0.0,<2.4.0 and <1.20.9. Fixed in 2.4.0 and 1.20.9; no exploitation reported (EPSS 0.366%).
What to do
- Upgrade body-parser to 2.4.0 (or 1.20.9 on the 1.x line) and redeploy affected services
- As an interim mitigation, pass inflate: false to body-parser middleware where compressed request bodies are not needed
- Audit Express/Node services for body-parser usage and add process-level crash recovery/restarts (e.g. health checks, auto-restart) as defense in depth
- Monitor for crash loops or uncaught exceptions that could indicate probing
Fixed versions
- body-parser 2.4.0
- body-parser 1.20.9
Sources
All live incidents on Threat Watch
