Every CVE Search/ Get API key

CVE-2024-45590

body-parser vulnerable to denial of service when url encoding is enabled

7.5 HighPublic exploitFix available

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.82%Up 0.8 points since Sep 11, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
CVE-2024-45590
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
EUVDEUVD-2024-2860 7.5

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
EUVD-2024-2860
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-qwcr-r2fm-qrc7 8.7

body-parser vulnerable to denial of service when url encoding is enabled

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

Record
GHSA-qwcr-r2fm-qrc7
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
NVD 7.5

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
CVE-2024-45590
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
OSVAZL-49071 7.5

CVE-2024-45590 affecting package python-tensorboard for versions less than 2.16.2-5

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
AZL-49071
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-49097 7.5

CVE-2024-45590 affecting package js-jquery 3.5.0-4

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
AZL-49097
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 14 moreShow less
OSVAZL-49126 7.5

CVE-2024-45590 affecting package reaper for versions less than 3.1.1-13

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
AZL-49126
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVAZL-49149 7.5

CVE-2024-45590 affecting package js-jquery 3.5.0-4

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
AZL-49149
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSV 7.5

body-parser vulnerable to denial of service when url encoding is enabled

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
CVE-2024-45590
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
OSVDEBIAN-CVE-2024-45590 7.5

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
DEBIAN-CVE-2024-45590
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-qwcr-r2fm-qrc7 8.7

body-parser vulnerable to denial of service when url encoding is enabled

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

Record
GHSA-qwcr-r2fm-qrc7
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-405
Updated
2026-11-02
OSVUBUNTU-CVE-2024-45590 7.5

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Record
UBUNTU-CVE-2024-45590
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1772583201 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.14.2-tuxcare.1.

Record
CLSA-2026-1772583201
Updated
2026-11-02
OSVCLSA-2026-1773793044 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.8.4-tuxcare.1.

Record
CLSA-2026-1773793044
Updated
2026-11-02
OSVCLSA-2026-1774225187 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.13.3-tuxcare.1.

Record
CLSA-2026-1774225187
Updated
2026-11-02
OSVCLSA-2026-1782262676 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.19.0-tuxcare.1.

Record
CLSA-2026-1782262676
Updated
2026-11-02
OSVCLSA-2026-1782262677 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.1-tuxcare.1.

Record
CLSA-2026-1782262677
Updated
2026-11-02
OSVCLSA-2026-1782262678 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.1.

Record
CLSA-2026-1782262678
Updated
2026-11-02
OSVCLSA-2026-1784596340 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.0-tuxcare.1.

Record
CLSA-2026-1784596340
Updated
2026-11-02
OSVCLSA-2026-1792586687 No score

TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.2.

Record
CLSA-2026-1792586687
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
body-parser
npm
 before 1.20.3
1.20.3
python-tensorboard
Azure Linux:3
 before 2.16.2-5
2.16.2-5
js-jquery
Azure Linux:2
 through 3.5.0-4 None known
reaper
Azure Linux:2
 before 3.1.1-13
3.1.1-13
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
body-parser
TuxCare:npm
 1.14.2-tuxcare.0 up to 1.14.2-tuxcare.1, plus listed versions
1.14.2
1.14.2-tuxcare.1
body-parser
TuxCare:npm
 1.8.4-tuxcare.0 up to 1.8.4-tuxcare.1, plus listed versions
1.8.4
1.8.4-tuxcare.1
body-parser
TuxCare:npm
 1.13.3-tuxcare.0 up to 1.13.3-tuxcare.1, plus listed versions
1.13.3
1.13.3-tuxcare.1
body-parser
TuxCare:npm
 1.19.0-tuxcare.0 up to 1.19.0-tuxcare.1, plus listed versions
1.19.0
1.19.0-tuxcare.1
body-parser
TuxCare:npm
 1.20.1-tuxcare.0 up to 1.20.1-tuxcare.1, plus listed versions
1.20.1
1.20.1-tuxcare.1
Show 11 moreShow less
Affected packages
PackageAffectedFixed
body-parser
TuxCare:npm
 1.20.2-tuxcare.0 up to 1.20.2-tuxcare.1, plus listed versions
1.20.2
1.20.2-tuxcare.1
body-parser
TuxCare:npm
 1.20.0-tuxcare.0 up to 1.20.0-tuxcare.1, plus listed versions
1.20.0
1.20.0-tuxcare.1
body-parser
TuxCare:npm
 1.18.2-tuxcare.0 up to 1.18.2-tuxcare.2, plus listed versions
1.18.21.18.2-tuxcare.1
1.18.2-tuxcare.2
node-body-parser
Debian:12
 All versions, plus listed versions
1.20.1+~1.19.2-11.20.2+~1.19.5-11.20.3+~1.19.5-11.20.3+~1.19.5-21.20.3+~1.19.5-3
Show 7 moreShow less
2.2.0+~1.19.6-12.2.0+~1.19.6-22.2.0+~1.19.6-32.2.1+~1.19.6-12.2.2+~1.19.6-12.3.0+~1.19.6-12.4.0+~1.19.6-1
 None known
node-body-parser
Debian:13
 before 1.20.3+~1.19.5-1
1.20.3+~1.19.5-1
node-body-parser
Debian:14
 before 1.20.3+~1.19.5-1
1.20.3+~1.19.5-1
node-body-parser
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.8.1-1
 None known
node-body-parser
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.1-11.8.1-1ubuntu1
 None known
node-body-parser
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.18.3-21.19.0-2
 None known
node-body-parser
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.19.0-21.19.0-51.19.1+~1.19.2-11.19.2+~1.19.2-1
 None known
node-body-parser
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.20.1+~1.19.2-11.20.2+~1.19.5-11.20.2+~1.19.5-1build2
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubdhruvik-git/CVE-2024-455902025-09-02
PoC in GitHubEvillm/CVE-2024-45590-PoC2026-02-04

History

History
RecordedChangedSources
affected, aliases
affected, exploits, factsOSV
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45590 is a high vulnerability (CVSS 7.5) in Body-parser, published September 10, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in body-parser 1.20.3.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open