Description
Express depends on body-parser@^2.2.1, which resolves to a version affected by
CVE-2026-12590 (GHSA-v422-hmwv-36x6). body-parser >=2.0.0 <2.3.0 fails open
when given an invalid limit option value — bytes.parse() returns null and
request body size enforcement is silently disabled, allowing a DoS via oversized
payloads. This is flagged by scanners such as Trivy.
Expected
body-parser resolves to the patched 2.3.0, which throws on an invalid limit
at parser initialization.
Fix
A fix is proposed in #7390, which bumps the dependency to body-parser@^2.3.0.
References
Description
Express depends on
body-parser@^2.2.1, which resolves to a version affected byCVE-2026-12590 (GHSA-v422-hmwv-36x6). body-parser
>=2.0.0 <2.3.0fails openwhen given an invalid
limitoption value —bytes.parse()returnsnullandrequest body size enforcement is silently disabled, allowing a DoS via oversized
payloads. This is flagged by scanners such as Trivy.
Expected
body-parserresolves to the patched2.3.0, which throws on an invalidlimitat parser initialization.
Fix
A fix is proposed in #7390, which bumps the dependency to
body-parser@^2.3.0.References