Read the docs
TI-2026-79287 Aliases CVE-2026-111181GHSA-27r3-jxmh-p828

Crash in body-parser via trailing bytes after compressed request body

Priority LOW 39CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

body-parser versions before 1.20.9 and from 2.0.0 before 2.4.0 are affected. The middleware leaves the decompression stream for a Content-Encoding such as gzip without an error listener, so trailing bytes after a valid compressed frame raise an error that is thrown as an uncaught exception (CWE-248). A remote unauthenticated attacker can send one request to crash any Node.js application that uses body-parser with default options, because body parsing runs before routing.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed body-parser (body-parser): 2.4.0, 1.20.9body-parser (npm): 2.4.0, 1.20.9Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
body-parserbody-parser2.0.0 to before 2.4.0; before 1.20.92.4.0, 1.20.9Patch availableCNA
—body-parser (npm)2.0.0 to before 2.4.02.4.0Patch availableGHSA-27r3-jxmh-p828
—body-parser (npm)before 1.20.91.20.9Patch availableGHSA-27r3-jxmh-p828
  • body-parser Vendorbody-parser Affected 2.0.0 to before 2.4.0; before 1.20.9 Fixed in 2.4.0, 1.20.9 Patch available CNA
  • body-parser (npm) Vendor— Affected 2.0.0 to before 2.4.0 Fixed in 2.4.0 Patch available GHSA-27r3-jxmh-p828
  • body-parser (npm) Vendor— Affected before 1.20.9 Fixed in 1.20.9 Patch available GHSA-27r3-jxmh-p828

Remediation

Upgrade body-parser to 1.20.9 on the 1.x line or to 2.4.0 on the 2.x line. Red Hat fixes this in Red Hat Hardened Images through RHSA-2026:90388, RHSA-2026:90990, RHSA-2026:91181 and RHSA-2026:91292. As a workaround, set the inflate option to false so encoded requests are rejected before any decompression stream is created.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA body-parser (body-parser) Fixed in 2.4.0, 1.20.9
  • Fix · GHSA-27r3-jxmh-p828 body-parser (npm) Fixed in 2.4.0 Advisory →
  • Fix · GHSA-27r3-jxmh-p828 body-parser (npm) Fixed in 1.20.9 Advisory →

Red Hat 4 advisories

  • RHSA-2026:91292 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.5.hum1@aarch64, grafana12.4-12.4.13-0.5.hum1@src, grafana12.4-12.4.13-0.5.hum1@x86_64
  • RHSA-2026:91181 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.1-13.1.8-0.5.hum1@aarch64, grafana13.1-13.1.8-0.5.hum1@s390x, grafana13.1-13.1.8-0.5.hum1@src +1
  • RHSA-2026:90990 Released 2026-10-27 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana13.2-13.2.4-0.4.hum1@aarch64, grafana13.2-13.2.4-0.4.hum1@s390x, grafana13.2-13.2.4-0.4.hum1@src +1
Show 1 more Red Hat advisories
  • RHSA-2026:90388 Released 2026-10-26 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images grafana12.4-12.4.13-0.4.hum1@aarch64, grafana12.4-12.4.13-0.4.hum1@src, grafana12.4-12.4.13-0.4.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:90388, RHSA-2026:90990, RHSA-2026:91181, RHSA-2026:91292
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-111181
  2. 2026-10-22 CISA SSVC decision points changed
  3. 2026-10-22 Priority changed: MEDIUM → LOW
  4. 2026-10-23 Affected versions changed · Red Hat
  5. 2026-10-23 CVSS score added · Red Hat
  6. 2026-10-23 Alias added: GHSA-27r3-jxmh-p828
  7. 2026-10-23 Fix available: npm/[email protected], npm/[email protected] · GHSA-27r3-jxmh-p828
  8. 2026-10-23 CVSS score added · GHSA-27r3-jxmh-p828
  9. 2026-10-23 Weakness changed · GHSA-27r3-jxmh-p828
  10. 2026-10-23 8 new references · GHSA-27r3-jxmh-p828
  11. 2026-10-29 Fix available: Red Hat Hardened Images · Red Hat
  12. 2026-10-30 Fix available: RHSA-2026:90388 · Red Hat
  13. 2026-10-30 Fix available: RHSA-2026:90990 · Red Hat
  14. 2026-10-30 Fix available: RHSA-2026:91181 · Red Hat
  15. 2026-10-30 Fix available: RHSA-2026:91292 · Red Hat
  16. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

Other 7

  • TI-2025-12310 body-parser vulnerable to denial of service when url encoding is used CVSS 4.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences