CVE-2026-12590Medium· 5.9▾ SunlitA flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily l…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.4%
Last analysed / modified upstream
3.7 → 5.9
low → medium
A flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily large payloads, consuming excessive memory and CPU resources. This can lead to a Denial of Service (DoS) condition, making the application unavailable to legitimate users.
body-parser: body-parser: Denial of Service via invalid limit option — rated Moderate by Red Hat. Released 2026-07-09, updated 2026-10-15.
Affected:
No fix planned:
Not affected:
Fix deferred
Workarounds / mitigations:
Affected packages:
body-parser < 1.20.6body-parser >= 2.0.0, < 2.3.0Patched in:
body-parser 1.20.6body-parser 2.3.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73089High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
CVE-2026-95502Medium· 5.3A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption)
CVE-2026-33374Medium· 6.5The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions.
CVE-2026-75140High· 7.5jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBuilder that allows remote attackers to exhaust JVM heap memory by supplying a deeply nested XML document with uniquely-…
CVE-2026-80212High· 7.5An issue was discovered in the resolv gem before 0.7.2 for Ruby
CVE-2026-14620Medium· 4.7webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the …