{"id":"CVE-2024-45590","aliases":["AZL-49071","AZL-49097","AZL-49126","AZL-49149","CLSA-2026-1772583201","CLSA-2026-1773793044","CLSA-2026-1774225187","CLSA-2026-1782262676","CLSA-2026-1782262677","CLSA-2026-1782262678","CLSA-2026-1784596340","CLSA-2026-1792586687","DEBIAN-CVE-2024-45590","EUVD-2024-2860","GHSA-qwcr-r2fm-qrc7","UBUNTU-CVE-2024-45590"],"status":"published","title":"body-parser vulnerable to denial of service when url encoding is enabled","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00824,"percentile":0.57806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-405"],"published":"2024-09-10T15:52:39Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"dhruvik-git/CVE-2024-45590","title":"dhruvik-git/CVE-2024-45590","date":"2025-09-02","url":"https://github.com/dhruvik-git/CVE-2024-45590"},{"source":"pocgithub","id":"Evillm/CVE-2024-45590-PoC","title":"Evillm/CVE-2024-45590-PoC","date":"2026-02-04","url":"https://github.com/Evillm/CVE-2024-45590-PoC"}],"fixes":[{"ecosystem":"npm","package":"body-parser","fixed_in":["1.20.3"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-tensorboard","fixed_in":["2.16.2-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"reaper","fixed_in":["3.1.1-13"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"body-parser","fixed_in":["1.14.2-tuxcare.1","1.8.4-tuxcare.1","1.13.3-tuxcare.1","1.19.0-tuxcare.1","1.20.1-tuxcare.1","1.20.2-tuxcare.1","1.20.0-tuxcare.1","1.18.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-body-parser","fixed_in":["1.20.3+~1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-body-parser","fixed_in":["1.20.3+~1.19.5-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.2-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"reaper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-13"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.2-tuxcare.0"},{"fixed":"1.14.2-tuxcare.1"}]}],"versions":["1.14.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.4-tuxcare.0"},{"fixed":"1.8.4-tuxcare.1"}]}],"versions":["1.8.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.3-tuxcare.0"},{"fixed":"1.13.3-tuxcare.1"}]}],"versions":["1.13.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0-tuxcare.0"},{"fixed":"1.19.0-tuxcare.1"}]}],"versions":["1.19.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-tuxcare.0"},{"fixed":"1.20.1-tuxcare.1"}]}],"versions":["1.20.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-tuxcare.0"},{"fixed":"1.20.2-tuxcare.1"}]}],"versions":["1.20.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0-tuxcare.0"},{"fixed":"1.20.0-tuxcare.1"}]}],"versions":["1.20.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.2-tuxcare.0"},{"fixed":"1.18.2-tuxcare.2"}]}],"versions":["1.18.2","1.18.2-tuxcare.1"]},{"source":"osv","ecosystem":"Debian:12","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1+~1.19.2-1","1.20.2+~1.19.5-1","1.20.3+~1.19.5-1","1.20.3+~1.19.5-2","1.20.3+~1.19.5-3","2.2.0+~1.19.6-1","2.2.0+~1.19.6-2","2.2.0+~1.19.6-3","2.2.1+~1.19.6-1","2.2.2+~1.19.6-1","2.3.0+~1.19.6-1","2.4.0+~1.19.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3+~1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3+~1.19.5-1"}]}]},{"source":"osv","ecosystem":"npm","package":"body-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.8.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-2","1.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.0-2","1.19.0-5","1.19.1+~1.19.2-1","1.19.2+~1.19.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1+~1.19.2-1","1.20.2+~1.19.5-1","1.20.2+~1.19.5-1build2"]}],"products":[{"vendor":"body-parser","product":"body-parser"},{"vendor":"expressjs","product":"body-parser"},{"vendor":"openjsf","product":"body-parser"}],"references":[{"url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45590","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qwcr-r2fm-qrc7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45590.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45590","tags":["advisory"]},{"url":"https://github.com/expressjs/body-parser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-45590","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45590","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-45590","title":"body-parser vulnerable to denial of service when url encoding is enabled","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T15:54:02.33Z","modified":"2024-09-10T18:47:22.965Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-2860","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T15:54:02Z","modified":"2024-09-10T18:47:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:58.744683Z"}],"ghsa":[{"id":"GHSA-qwcr-r2fm-qrc7","title":"body-parser vulnerable to denial of service when url encoding is enabled","description":"### Impact\n\nbody-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.\n\n### Patches\n\nthis issue is patched in 1.20.3\n\n### References\n","status":"published","published":"2024-09-10T15:52:39Z","modified":"2024-09-10T19:01:11Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:38:02.014847Z"}],"nvd":[{"id":"CVE-2024-45590","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21.083Z","modified":"2026-06-17T07:54:31.697Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T14:10:25.561537Z"}],"osv":[{"id":"AZL-49071","title":"CVE-2024-45590 affecting package python-tensorboard for versions less than 2.16.2-5","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"AZL-49097","title":"CVE-2024-45590 affecting package js-jquery 3.5.0-4","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21Z","modified":"2026-04-21T04:29:46.253333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49126","title":"CVE-2024-45590 affecting package reaper for versions less than 3.1.1-13","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21Z","modified":"2026-04-21T04:29:46.863968Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:06.032783Z"},{"id":"AZL-49149","title":"CVE-2024-45590 affecting package js-jquery 3.5.0-4","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.514083Z"},{"id":"CVE-2024-45590","title":"body-parser vulnerable to denial of service when url encoding is enabled","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T15:54:02.33Z","modified":"2026-11-11T10:30:34.926517422Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-405"],"updated_at":"2026-11-11T11:06:29.968286Z"},{"id":"DEBIAN-CVE-2024-45590","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:21.083Z","modified":"2026-11-02T12:02:49.166584807Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"GHSA-qwcr-r2fm-qrc7","title":"body-parser vulnerable to denial of service when url encoding is enabled","description":"### Impact\n\nbody-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.\n\n### Patches\n\nthis issue is patched in 1.20.3\n\n### References\n","status":"published","published":"2024-09-10T15:52:39Z","modified":"2026-09-10T03:50:18.292199548Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-405"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2024-45590","description":"body-parser is Node.js body parsing middleware. body-parser \u003c1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.","status":"published","published":"2024-09-10T16:15:00Z","modified":"2025-10-24T05:12:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"CLSA-2026-1772583201","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.14.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:10Z","modified":"2026-10-15T09:45:25.335028412Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773793044","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.8.4-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.106314615Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774225187","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.13.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-15T09:47:00.827061835Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1782262676","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.19.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:45:56.246668993Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262677","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:45:55.845228828Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782262678","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:39Z","modified":"2026-10-15T09:47:10.058504802Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1784596340","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:36.234367202Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1792586687","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.2.","status":"published","published":"2026-10-21T12:44:47Z","modified":"2026-10-21T20:31:55.452270369Z","updated_at":"2026-11-02T15:43:54.672859Z"}]}}