Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
Do Son 
TL;DR
A body-parser vulnerability tracked as CVE-2026-111181 lets a remote client crash a Node.js server with a single request. The flaw scores 7.5 on CVSS v3.1. It hits body-parser, the middleware that Express apps use to read request bodies.
A crafted compressed request can kill the whole Node.js process. Most apps are exposed because body-parser accepts compressed bodies by default. Upgrade to body-parser 2.4.0 or 1.20.9.
- CVE: CVE-2026-111181
- CVSS: 7.5 (High · CVSSv3)
- Product: body-parser
- Affected: 2.0.0, < 1.20.9
- Impact: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
- Status: No confirmed exploitation yet
- Patched in: 2.4.0, 1.20.9
- EPSS: 0.4% (30-day)
- Action: Update to 2.4.0, 1.20.9 now
Why It Matters
Gavin Stuart detailed the bug in a post on the Express blog. He warns that “body-parser accepts compressed requests by default, rendering most unpatched versions vulnerable.” This Express denial of service can also spread fast. According to the post, an attacker could “take down an entire load-balanced cluster by spreading a handful of requests across vulnerable nodes.”
Worse, no login is needed when the parser runs before authentication. The CVE record adds that “no matching route is required because body parsing runs before routing.”
How the Attack Works
The post explains that “the decompression stream outlives the request parsing.” After body-parser reads the body, the decoder stays open with no error handler. Consequently, extra bytes that arrive later trigger an error that nothing catches. Node treats it as an uncaught exception, and the process crashes.
The Express write-up includes a reproduction, so details of this Express denial of service are now public. So far, no attacks have been confirmed, and the flaw is not in CISA’s KEV catalog.
Affected Versions
The body-parser vulnerability affects these releases:
- body-parser 2.0.0 through 2.3.0
- body-parser 1.20.8 and earlier
Patch and Mitigation
Install body-parser 2.4.0 or 1.20.9, which shipped on npm on October 22. If your app does not need compressed bodies, set the inflate option to false. However, the advisory warns, “This workaround rejects compressed bodies.”
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
