Source: node-body-parser Version: 2.3.0+~1.19.6-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for node-body-parser. CVE-2026-111181[0]: | body-parser is body parsing middleware for Node.js and Express. In | versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a | single request can crash any application using body-parser with | default options. When a request carries a Content-Encoding such as | gzip, body-parser pipes it into a decompression stream and, after | reading the body, leaves that stream with no error listener. A | payload of one valid compressed frame followed by trailing bytes | decodes and the application responds normally, but the trailing | bytes then reach the already-finished decoder, which emits an error | that is re-thrown as an uncaught exception and terminates the | process. No matching route is required because body parsing runs | before routing, so any endpoint that parses a body is affected. The | issue is fixed in body-parser 2.4.0 and 1.20.9, and users should | upgrade to one of those versions or later. As a workaround, disable | request-body inflation (set the body-parser inflate option to false) | so encoded requests are rejected before any decompression stream is | created. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-111181 https://www.cve.org/CVERecord?id=CVE-2026-111181 [1] https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828 Please adjust the affected versions in the BTS as needed. Regards, Salvatore -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
