Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The npm package body-parser, in versions before 1.20.9 and from 2.0.0 before 2.4.0, can crash a process when a request has a Content-Encoding such as gzip and its body is one valid compressed frame followed by trailing bytes. No authentication or matching route is needed, since parsing happens before routing, so a single request can terminate an application using default options. Upgrade to body-parser 1.20.9 or 2.4.0. As a workaround, set inflate to false if compressed request bodies are not needed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (openjs) |
- CISA KEV Not listed.
- EPSS 0.0039, the 33rd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:33 UTC First seen by agentprime
- 31 Oct 2026, 13:33 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-27r3-jxmh-p828
- OSV: GHSA-27r3-jxmh-p828
- github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
- nvd.nist.gov/vuln/detail/CVE-2026-111181
- github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7
- github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916
- cna.openjsf.org/security-advisories.html
- github.com/expressjs/body-parser
- github.com/expressjs/body-parser/releases/tag/1.20.9
- github.com/expressjs/body-parser/releases/tag/v2.4.0