Body parser flaw lets one request crash Express servers

A vulnerability in the body-parser middleware, tracked as CVE-2026-111181, could cause a Node.js/Express server to crash with a single specially crafted request. The CVSS v3.1 score is 7.5 (High). The flaw affects body-parser versions 2.0.0 through 2.3.0 and 1.20.8 and earlier, with the issue arising because the decompression stream outlives request parsing and can trigger an uncaught exception when extra bytes arrive after the body has been read.

Gavin Stuart outlined the bug on the Express blog, noting that body-parser accepts compressed requests by default, making unpatched instances vulnerable and enabling a denial-of-service that could spread across a load-balanced cluster if multiple nodes are targeted. The CVE entry confirms that no login is required and that body parsing runs before routing, increasing potential impact.

Evidence and response details provided in the reporting indicate a reproducible demonstration exists in the Express write-up, with a public PoC now available. However, as of the article, there have been no confirmed exploitation reports, and the vulnerability is not yet listed in CISA KEV. Patches are available in body-parser versions 2.4.0 and 1.20.9, released on 22 October.

If compressed bodies are not needed, setting inflate to false is suggested, though the advisory warns this workaround rejects compressed bodies. Organisations running affected versions should update promptly to mitigate potential remote denial-of-service impact.