Your message dated Fri, 23 Oct 2026 21:12:47 +0000
with message-id <[email protected]>
and subject line Bug#1151838: fixed in node-body-parser 2.4.0+~1.19.6-1
has caused the Debian Bug report #1151838,
regarding node-body-parser: CVE-2026-111181
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151838: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151838
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-body-parser
Version: 2.3.0+~1.19.6-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-body-parser.
CVE-2026-111181[0]:
| body-parser is body parsing middleware for Node.js and Express. In
| versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a
| single request can crash any application using body-parser with
| default options. When a request carries a Content-Encoding such as
| gzip, body-parser pipes it into a decompression stream and, after
| reading the body, leaves that stream with no error listener. A
| payload of one valid compressed frame followed by trailing bytes
| decodes and the application responds normally, but the trailing
| bytes then reach the already-finished decoder, which emits an error
| that is re-thrown as an uncaught exception and terminates the
| process. No matching route is required because body parsing runs
| before routing, so any endpoint that parses a body is affected. The
| issue is fixed in body-parser 2.4.0 and 1.20.9, and users should
| upgrade to one of those versions or later. As a workaround, disable
| request-body inflation (set the body-parser inflate option to false)
| so encoded requests are rejected before any decompression stream is
| created.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-111181
https://www.cve.org/CVERecord?id=CVE-2026-111181
[1]
https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-body-parser
Source-Version: 2.4.0+~1.19.6-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-body-parser, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-body-parser package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 23 Oct 2026 22:51:32 +0200
Source: node-body-parser
Architecture: source
Version: 2.4.0+~1.19.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1151838
Changes:
node-body-parser (2.4.0+~1.19.6-1) unstable; urgency=medium
.
* Team upload
* New upstream version (Closes: #1151838, CVE-2026-111181)
Checksums-Sha1:
a8496b6518e5fcc3a6379511612832d7243e4db9 2747
node-body-parser_2.4.0+~1.19.6-1.dsc
1859bebb8fd7dac9918a45d54c1971ab8b5af474 2945
node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
5fcbd056373221ade97d296a534046a83e7fa955 32926
node-body-parser_2.4.0+~1.19.6.orig.tar.gz
3405a8df21c945a430b18eba1a9ffb85f6501f0d 3936
node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
Checksums-Sha256:
36a5b281b137ce2e8fca15329464760f273de06a2d440208434ca3f8dbaf0e8e 2747
node-body-parser_2.4.0+~1.19.6-1.dsc
640c729c03c2527aca389e1e134d342a5ccee6b394b700e297141f580fe89f8a 2945
node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
49e3e2623c2cff5e255cab76b6398455970be7fcb46a528902244d112df3faec 32926
node-body-parser_2.4.0+~1.19.6.orig.tar.gz
8b2e5030453433dff5d404e84fc0cffb881c87e744d8af456b473183014d95cc 3936
node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
Files:
bc01d4d95638385f1c4f4d24f302f309 2747 javascript optional
node-body-parser_2.4.0+~1.19.6-1.dsc
ecea4b2ead546efcfaa132b3bdf8c290 2945 javascript optional
node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
3cdf6a75ce5cd83074752cb08f33cb63 32926 javascript optional
node-body-parser_2.4.0+~1.19.6.orig.tar.gz
1d6d36abe9d1774f68dedca313011671 3936 javascript optional
node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrbyTYACgkQ9tdMp8mZ
7unFzg//Uxvvd7TC7X+IePezdZCIK6MZC563lMrKeK+r+kBrQbZOGTYReFEwaEzA
EjfwujR/wgG2OyHixOps3TOjtBO1Qv9/Cvml/AiKd/JAvvNaqKJJ7Q3EwveufGNM
AGccO+TAL89mWWdNkhA039yz6NIP+Wv/rEBjxlzLHjvM7fzoOI9Ug4mtx4LgKqut
iPulFICSvWGDm3LBtJiXk1gNQLXy7J8zRpgNzUrhQavnCKmwFhxVze28wz6RssnL
VRYzmRF0NZNRaLQv/Q12XXXQxcY4mZifOJEgzJ/PXn5wy1IHVFxczcW5iLWiwoyk
NKZBhlUeSFLXHo63R1sa8YSZFawJoho6oRUsHX6k9FJyBVZJJZC3pXS8QroYJpjF
Bb7yVZGCw2cipkUkQdosKb6fvOoGXJyhhLJw/iD6ogKOfZeu8dLpTy2C2ANz9IfB
PL9Vd9e9Cj7EJ7qbM/ITEy8x8b/vJsfuHhFRcGWEle49QRxkjvVLp5l/HCcCZ48O
c/i1ad/QEIawi44NqGX03Lxmyz28WcAsELwWLwsR0+fWnf+YJuJv0DBmBdkYxEWS
OD6Ld9m+zgIGUAHcRMcnN4iC/UW3NSK+LqWBz3Fk/R0VcOa5HIaddZYoWNDP6ESx
9zI4zMQeVZRfrXeC4hdwDUCjyhFzI1mEZYSuxbiaRwST86dAs9g=
=yDLn
-----END PGP SIGNATURE-----
pgpcQVLh6qC4x.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
