body-parser vulnerable to denial of service when url encoding is enabled

HIGH 7.5CVE-2024-45590 · GHSA-qwcr-r2fm-qrc7 · Published 10/09/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
body-parser openjsf	`< 1.20.3`	`1.20.3`
body-parser npm	`< 1.20.3`	`1.20.3`

Description

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

NVD description

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

References

expressjs/body-parser security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2024-45590 · ADVISORY
expressjs/body-parser commit b2695c4 · WEB
expressjs/body-parser · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free