openjsf body-parser vulnerabilities

Latest openjsf body-parser CVEs

Newest publication first

1. CVE-2026-12590 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

   Published 2026-07-09

   Medium·CVSS 5.9 EPSS 0.41%

   Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that...

2. CVE-2024-45590 body-parser vulnerable to denial of service when url encoding is enabled

   Published 2024-09-10

   High·CVSS 7.5 EPSS 0.82%

   body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This is...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.