CVE-2026-111181High· 7.5▾ Twilightbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.4%
A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.
Fixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.
Pass inflate: false to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.
body-parser >= 2.0.0, < 2.4.0body-parser < 1.20.9Upgrade to a patched release:
body-parser 2.4.0body-parser 1.20.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-109869High· 7.5undici is an HTTP client library for Node.js
CVE-2026-109855High· 7.5undici is an HTTP client library for Node.js
CVE-2026-92081Medium· 5.9fastify is a fast and low-overhead web framework for Node.js
CVE-2026-87018High· 7.5undici is an HTTP client library for Node.js
CVE-2026-87029Medium· 5.9undici is an HTTP client library for Node.js