CVE-2026-111181

Name of the Vulnerable Software and Affected Versions body-parser versions prior to 1.20.9 body-parser versions 2.0.0 through 2.3.x

Description An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pipes it into a decompression stream but fails to attach an error listener after reading the body. If a payload contains one valid compressed frame followed by trailing bytes, the application responds normally to the valid frame, but the trailing bytes trigger an error in the finished decoder. This error is re-thrown as an uncaught exception, terminating the process. Since body parsing occurs before routing, any endpoint that parses a body is affected.

Recommendations Update to version 1.20.9 or later. Update to version 2.4.0 or later. As a temporary workaround, disable request-body inflation by setting the inflate option to false to reject encoded requests before a decompression stream is created.