{"id":"CVE-2026-12590","title":"body-parser: body-parser: Denial of Service via invalid limit option (CVE-2026-12590)","summary":"A flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily l…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","affected":["confidential_compute_attestation","cryostat 4","gatekeeper 3","migration_toolkit_for_applications 8","migration_toolkit_for_containers","node_healthcheck_operator","openshift_lightspeed","openshift_pipelines","openshift_serverless","openshift_service_mesh 3","amq_broker 7","ansible_automation_platform 2","build_of_apache_camel_hawtio 4","build_of_apache_camel_for_spring_boot 4","build_of_podman_desktop","connectivity_link 1","data_grid 8","developer_hub","discovery 2","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai 3","jboss_enterprise_application_platform_expansion_pack","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","openshift_virtualization 4","quay 3","satellite 6","trusted_artifact_signer","trusted_profile_analyzer","self_service_automation_portal 2"],"patched":["body-parser 1.20.6","body-parser 2.3.0"],"published":"2026-07-09","updated":"2026-10-15","sourceUpdated":"2026-10-15T11:32:39+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-12590"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498472"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12590"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"},{"url":"https://github.com/expressjs/body-parser/pull/698"},{"url":"https://github.com/expressjs/body-parser/pull/741"},{"url":"https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d"},{"url":"https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac"},{"url":"https://github.com/expressjs/body-parser/releases/tag/1.20.6"},{"url":"https://github.com/expressjs/body-parser/releases/tag/v2.3.0"},{"url":"https://github.com/advisories/GHSA-v422-hmwv-36x6"}],"tags":["csaf","vex","red-hat","ghsa","npm","score-dispute"],"epss":0.00412,"epssPercentile":0.35292,"aliases":["GHSA-v422-hmwv-36x6"],"ecosystem":"npm","scores":{"vendor":5.9,"ghsa":3.7},"ingestedAt":"2026-07-20T23:44:02.286Z","slug":"CVE-2026-12590","body":"## Overview\n\nA flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily large payloads, consuming excessive memory and CPU resources. This can lead to a Denial of Service (DoS) condition, making the application unavailable to legitimate users.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Cryostat 4, Gatekeeper 3, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Node HealthCheck Operator, … · no fix planned: Confidential Compute Attestation, Cryostat 4, Gatekeeper 3, Migration Toolkit for Applications 8, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json)\n\n**body-parser: body-parser: Denial of Service via invalid limit option** — rated Moderate by Red Hat. Released 2026-07-09, updated 2026-10-15.\n\nAffected:\n\n- Confidential Compute Attestation\n- Cryostat 4\n- Gatekeeper 3\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n- Self-service automation portal 2\n\nNo fix planned:\n\n- Confidential Compute Attestation\n- Cryostat 4\n- Gatekeeper 3\n- Migration Toolkit for Applications 8\n- Migration Toolkit for Containers\n- Node HealthCheck Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat build of Apache Camel - HawtIO 4\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Build of Podman Desktop\n- Red Hat Connectivity Link 1\n- Red Hat Data Grid 8\n- Red Hat Developer Hub\n- Red Hat Discovery 2\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat JBoss Enterprise Application Platform Expansion Pack\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Virtualization 4\n- Red Hat Quay 3\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n- Red Hat Trusted Profile Analyzer\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-12590)\n\nAffected packages:\n\n- `body-parser < 1.20.6`\n- `body-parser >= 2.0.0, < 2.3.0`\n\nPatched in:\n\n- `body-parser 1.20.6`\n- `body-parser 2.3.0`\n\nSource: https://github.com/advisories/GHSA-v422-hmwv-36x6","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":222201,"id":"CVE-2026-12590","ts":1792065066678,"field":"cvss","old":"3.7","new":"5.9"},{"seq":222200,"id":"CVE-2026-12590","ts":1792065066678,"field":"severity","old":"low","new":"medium"}]}