One compressed request can crash a Node.js app that uses body-parser with default options

CVE-2026-111181 was published October 22, 2026 by the OpenJS Foundation. It says that in body-parser before 1.20.9, and from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes normally and the application responds, but the trailing bytes then reach the finished decoder. The decoder emits an error that is re-thrown as an uncaught exception, and the process exits. No matching route is needed, because body parsing runs before routing. The record names CWE-248, and NVD lists a CVSS 3.1 score of 7.5 High.

The project's advisory, GHSA-27r3-jxmh-p828, says no authentication is required and that the fix is in body-parser 2.4.0 and 1.20.9. Its workaround, for apps that do not need to accept compressed request bodies, is to pass inflate: false to the body-parser middleware, so encoded requests are rejected before any decompression stream is created.

Express's own JSON and URL-encoded parsers use body-parser. According to the npm registry, Express 4.21 and earlier pin an exact body-parser release below 1.20.9, so those apps need an Express upgrade before they can get the fix. Express 4.22 and later on the 4.x line, and Express 5, accept the fixed body-parser versions, so updating the lockfile is enough.