---
id: CVE-2026-12590
title: >-
  body-parser: body-parser: Denial of Service via invalid limit option
  (CVE-2026-12590)
summary: >-
  A flaw was found in body-parser. When the parser is configured with an invalid
  limit option, such as an unparseable string or a non-numeric value, the
  request body size check is bypassed. This allows a remote attacker to send
  arbitrarily l…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-770
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - confidential_compute_attestation
  - cryostat 4
  - gatekeeper 3
  - migration_toolkit_for_applications 8
  - migration_toolkit_for_containers
  - node_healthcheck_operator
  - openshift_lightspeed
  - openshift_pipelines
  - openshift_serverless
  - openshift_service_mesh 3
  - amq_broker 7
  - ansible_automation_platform 2
  - build_of_apache_camel_hawtio 4
  - build_of_apache_camel_for_spring_boot 4
  - build_of_podman_desktop
  - connectivity_link 1
  - data_grid 8
  - developer_hub
  - discovery 2
  - enterprise_linux 10
  - enterprise_linux 8
  - enterprise_linux 9
  - enterprise_linux_ai_rhel_ai 3
  - jboss_enterprise_application_platform_expansion_pack
  - openshift_ai_rhoai
  - openshift_container_platform 4
  - openshift_data_foundation 4
  - openshift_dev_spaces
  - openshift_virtualization 4
  - quay 3
  - satellite 6
  - trusted_artifact_signer
  - trusted_profile_analyzer
  - self_service_automation_portal 2
patched:
  - body-parser 1.20.6
  - body-parser 2.3.0
published: '2026-07-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:32:39+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-12590'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2498472'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-12590'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12590'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: >-
      https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6
  - url: 'https://github.com/expressjs/body-parser/pull/698'
  - url: 'https://github.com/expressjs/body-parser/pull/741'
  - url: >-
      https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d
  - url: >-
      https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac
  - url: 'https://github.com/expressjs/body-parser/releases/tag/1.20.6'
  - url: 'https://github.com/expressjs/body-parser/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-v422-hmwv-36x6'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
  - score-dispute
epss: 0.00412
epssPercentile: 0.35292
aliases:
  - GHSA-v422-hmwv-36x6
ecosystem: npm
scores:
  vendor: 5.9
  ghsa: 3.7
ingestedAt: '2026-07-20T23:44:02.286Z'
---

## Overview

A flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily large payloads, consuming excessive memory and CPU resources. This can lead to a Denial of Service (DoS) condition, making the application unavailable to legitimate users.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Confidential Compute Attestation, Cryostat 4, Gatekeeper 3, Migration Toolkit for Applications 8, Migration Toolkit for Containers, Node HealthCheck Operator, … · no fix planned: Confidential Compute Attestation, Cryostat 4, Gatekeeper 3, Migration Toolkit for Applications 8, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12590.json)

**body-parser: body-parser: Denial of Service via invalid limit option** — rated Moderate by Red Hat. Released 2026-07-09, updated 2026-10-15.

Affected:

- Confidential Compute Attestation
- Cryostat 4
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Serverless
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Build of Podman Desktop
- Red Hat Connectivity Link 1
- Red Hat Data Grid 8
- Red Hat Developer Hub
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Virtualization 4
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer
- Red Hat Trusted Profile Analyzer
- Self-service automation portal 2

No fix planned:

- Confidential Compute Attestation
- Cryostat 4
- Gatekeeper 3
- Migration Toolkit for Applications 8
- Migration Toolkit for Containers
- Node HealthCheck Operator
- OpenShift Lightspeed
- OpenShift Pipelines
- OpenShift Serverless
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Ansible Automation Platform 2
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Build of Podman Desktop
- Red Hat Connectivity Link 1
- Red Hat Data Grid 8
- Red Hat Developer Hub
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat Openshift Data Foundation 4
- Red Hat OpenShift Dev Spaces
- Red Hat OpenShift Virtualization 4
- Red Hat Quay 3
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer
- Red Hat Trusted Profile Analyzer
- Self-service automation portal 2

Not affected:

- Red Hat Hardened Images

## Remediation

Fix deferred

Workarounds / mitigations:

- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

## Package advisory (CVE-2026-12590)

Affected packages:

- `body-parser < 1.20.6`
- `body-parser >= 2.0.0, < 2.3.0`

Patched in:

- `body-parser 1.20.6`
- `body-parser 2.3.0`

Source: https://github.com/advisories/GHSA-v422-hmwv-36x6