body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
CVE-2026-111181
Impact A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing. Patches Fixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions. Workarounds Pass inflate: false to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.
Assessment
- CVSS
- 7.5 (v3.1)
- Severity
- High
- EPSS
- 0.00388% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 23 October 2026
- Last updated
- 23 October 2026
- Affected
- npm · body-parser
- Weakness
- CWE-248
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
At the source
References
- https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
- https://nvd.nist.gov/vuln/detail/CVE-2026-111181
- https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7
- https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/body-parser/releases/tag/1.20.9
- https://github.com/expressjs/body-parser/releases/tag/v2.4.0
- https://github.com/advisories/GHSA-27r3-jxmh-p828
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-111181