Source: node-body-parser Version: 2.2.2+~1.19.6-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for node-body-parser. CVE-2026-12590[0]: | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 | (2.x line), when the parser is configured with an invalid limit | option value such as an unparseable string or NaN, bytes.parse | returns null and the request body size check is silently skipped. | Applications that rely on limit as their primary safeguard against | oversized request bodies will accept arbitrarily large payloads, | leading to excessive memory and CPU usage and denial of service. | Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After | the fix, invalid limit values throw a clear error at parser | construction time instead of silently disabling enforcement, while | null and undefined continue to fall back to the default limit of | 100kb. Workarounds: Validate the limit value before passing it to | body-parser. For example, parse the value at startup and reject any | configuration where the result is null or a non-finite number. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-12590 https://www.cve.org/CVERecord?id=CVE-2026-12590 [1] https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6 [2] https://github.com/expressjs/body-parser/pull/698 [3] https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d Please adjust the affected versions in the BTS as needed. Regards, Salvatore
