{"id":"CVE-2026-111181","aliases":["AZL-110999","AZL-111059","CLSA-2026-1793097203","CLSA-2026-1793098476","CLSA-2026-1793098695","CLSA-2026-1793098724","CLSA-2026-1793099858","CLSA-2026-1793290284","CLSA-2026-1793290420","CLSA-2026-1793290533","CLSA-2026-1793290669","CLSA-2026-1793290802","CLSA-2026-1793290939","CLSA-2026-1793292439","DEBIAN-CVE-2026-111181","EUVD-2026-108189","GHSA-27r3-jxmh-p828","UBUNTU-CVE-2026-111181","openSUSE-SU-2026:12424-1","openSUSE-SU-2026:12429-1"],"status":"published","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00388,"percentile":0.33344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248"],"published":"2026-10-22T14:29:56Z","modified":"2026-11-06T17:27:33Z","fixes":[{"ecosystem":"npm","package":"body-parser","fixed_in":["2.4.0","1.20.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"body-parser","fixed_in":["1.8.4-tuxcare.4","1.20.4-tuxcare.2","1.20.5-tuxcare.3","1.20.3-tuxcare.3","1.20.6-tuxcare.1","1.19.0-tuxcare.4","1.20.1-tuxcare.7","1.13.3-tuxcare.4","1.20.2-tuxcare.5","1.18.2-tuxcare.3","1.20.0-tuxcare.5","1.14.2-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-body-parser","fixed_in":["2.4.0+~1.19.6-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.4.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.9"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-tensorboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.16.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.4-tuxcare.0"},{"fixed":"1.8.4-tuxcare.4"}]}],"versions":["1.8.4","1.8.4-tuxcare.1","1.8.4-tuxcare.2","1.8.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.4-tuxcare.0"},{"fixed":"1.20.4-tuxcare.2"}]}],"versions":["1.20.4","1.20.4-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.5-tuxcare.0"},{"fixed":"1.20.5-tuxcare.3"}]}],"versions":["1.20.5","1.20.5-tuxcare.1","1.20.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.3-tuxcare.0"},{"fixed":"1.20.3-tuxcare.3"}]}],"versions":["1.20.3","1.20.3-tuxcare.1","1.20.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.6-tuxcare.0"},{"fixed":"1.20.6-tuxcare.1"}]}],"versions":["1.20.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0-tuxcare.0"},{"fixed":"1.19.0-tuxcare.4"}]}],"versions":["1.19.0","1.19.0-tuxcare.1","1.19.0-tuxcare.2","1.19.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.1-tuxcare.0"},{"fixed":"1.20.1-tuxcare.7"}]}],"versions":["1.20.1","1.20.1-tuxcare.1","1.20.1-tuxcare.2","1.20.1-tuxcare.3","1.20.1-tuxcare.4","1.20.1-tuxcare.5","1.20.1-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.3-tuxcare.0"},{"fixed":"1.13.3-tuxcare.4"}]}],"versions":["1.13.3","1.13.3-tuxcare.1","1.13.3-tuxcare.2","1.13.3-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.2-tuxcare.0"},{"fixed":"1.20.2-tuxcare.5"}]}],"versions":["1.20.2","1.20.2-tuxcare.1","1.20.2-tuxcare.2","1.20.2-tuxcare.3","1.20.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.18.2-tuxcare.0"},{"fixed":"1.18.2-tuxcare.3"}]}],"versions":["1.18.2","1.18.2-tuxcare.1","1.18.2-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.20.0-tuxcare.0"},{"fixed":"1.20.0-tuxcare.5"}]}],"versions":["1.20.0","1.20.0-tuxcare.1","1.20.0-tuxcare.2","1.20.0-tuxcare.3","1.20.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.14.2-tuxcare.0"},{"fixed":"1.14.2-tuxcare.5"}]}],"versions":["1.14.2","1.14.2-tuxcare.1","1.14.2-tuxcare.2","1.14.2-tuxcare.3","1.14.2-tuxcare.4"]},{"source":"osv","ecosystem":"Debian:12","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1+~1.19.2-1","1.20.2+~1.19.5-1","1.20.3+~1.19.5-1","1.20.3+~1.19.5-2","1.20.3+~1.19.5-3","2.2.0+~1.19.6-1","2.2.0+~1.19.6-2","2.2.0+~1.19.6-3","2.2.1+~1.19.6-1","2.2.2+~1.19.6-1","2.3.0+~1.19.6-1","2.4.0+~1.19.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3+~1.19.5-3","2.2.0+~1.19.6-1","2.2.0+~1.19.6-2","2.2.0+~1.19.6-3","2.2.1+~1.19.6-1","2.2.2+~1.19.6-1","2.3.0+~1.19.6-1","2.4.0+~1.19.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+~1.19.6-1"}]}],"versions":["1.20.3+~1.19.5-3","2.2.0+~1.19.6-1","2.2.0+~1.19.6-2","2.2.0+~1.19.6-3","2.2.1+~1.19.6-1","2.2.2+~1.19.6-1","2.3.0+~1.19.6-1"]},{"source":"osv","ecosystem":"npm","package":"body-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"body-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1","1.8.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.3-2","1.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.0-2","1.19.0-5","1.19.1+~1.19.2-1","1.19.2+~1.19.2-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.1+~1.19.2-1","1.20.2+~1.19.5-1","1.20.2+~1.19.5-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2+~1.19.6-1","2.3.0+~1.19.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-body-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.20.3+~1.19.5-3","2.2.0+~1.19.6-1","2.2.2+~1.19.6-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25+475.275dd4727-56.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"git-bug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-4.1"}]}],"bundled":3}],"products":[{"vendor":"body-parser","product":"body-parser"}],"references":[{"url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828","tags":["advisory","web","report"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181","tags":["web","advisory"]},{"url":"https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7","tags":["web"]},{"url":"https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916","tags":["web"]},{"url":"https://github.com/expressjs/body-parser/releases/tag/1.20.9","tags":["web"]},{"url":"https://github.com/expressjs/body-parser/releases/tag/v2.4.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-27r3-jxmh-p828"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111181.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-111181","tags":["advisory"]},{"url":"https://github.com/expressjs/body-parser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-111181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-111181","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-102277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-111756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-115897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-116689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-86472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-114604","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-111181","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T14:29:56.577Z","modified":"2026-10-22T19:00:31.729Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:20:15.34316Z"}],"euvd":[{"id":"EUVD-2026-108189","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T14:29:56Z","modified":"2026-10-22T19:00:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:34.021826Z"}],"ghsa":[{"id":"GHSA-27r3-jxmh-p828","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"### Impact\n\nA single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.\n\n### Patches\n\nFixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.\n\n### Workarounds\n\nPass `inflate: false` to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.","status":"published","published":"2026-10-23T20:53:11Z","modified":"2026-10-23T20:53:12Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:41:35.723785Z"}],"nvd":[{"id":"CVE-2026-111181","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T15:17:04.763Z","modified":"2026-10-22T19:17:35.797Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"CVE-2026-111181","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T14:29:56.577Z","modified":"2026-11-06T17:27:33.755606116Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-06T18:00:53.997314Z"},{"id":"DEBIAN-CVE-2026-111181","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T15:17:04.763Z","modified":"2026-10-26T08:00:08.54172359Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"GHSA-27r3-jxmh-p828","title":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","description":"### Impact\n\nA single request can crash any application using `body-parser` with default options. When a request carries a `Content-Encoding` (for example `gzip`), `body-parser` pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.\n\n### Patches\n\nFixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.\n\n### Workarounds\n\nPass `inflate: false` to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.","status":"published","published":"2026-10-23T20:53:11Z","modified":"2026-10-23T21:00:06.131613693Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:46:33.956911Z"},{"id":"UBUNTU-CVE-2026-111181","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T15:17:00Z","modified":"2026-10-28T17:50:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-110999","title":"CVE-2026-111181 affecting package js-jquery 3.5.0-4","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T15:17:04Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-111059","title":"CVE-2026-111181 affecting package python-tensorboard 2.16.2-6","description":"body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.","status":"published","published":"2026-10-22T15:17:04Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.368326Z"},{"id":"CLSA-2026-1793097203","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.8.4-tuxcare.4.","status":"published","published":"2026-10-27T10:33:23Z","modified":"2026-10-27T13:30:09.264648971Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793098476","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.4-tuxcare.2.","status":"published","published":"2026-10-27T10:54:36Z","modified":"2026-10-27T13:30:06.984340773Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793098695","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.5-tuxcare.3.","status":"published","published":"2026-10-27T10:58:14Z","modified":"2026-10-27T13:30:17.547014343Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793098724","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.3-tuxcare.3.","status":"published","published":"2026-10-27T10:58:44Z","modified":"2026-10-27T13:30:16.638612078Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793099858","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.6-tuxcare.1.","status":"published","published":"2026-10-27T11:17:38Z","modified":"2026-10-27T13:30:07.418184092Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793290284","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.19.0-tuxcare.4.","status":"published","published":"2026-10-29T17:11:25Z","modified":"2026-10-29T19:45:50.741347873Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793290420","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.1-tuxcare.7.","status":"published","published":"2026-10-29T17:13:41Z","modified":"2026-10-29T19:45:49.219318306Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793290533","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.13.3-tuxcare.4.","status":"published","published":"2026-10-29T17:15:34Z","modified":"2026-10-29T19:45:49.060936189Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793290669","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.5.","status":"published","published":"2026-10-29T17:17:49Z","modified":"2026-10-29T19:45:50.596260229Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793290802","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.3.","status":"published","published":"2026-10-29T17:20:02Z","modified":"2026-10-29T19:45:50.351998625Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793290939","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.0-tuxcare.5.","status":"published","published":"2026-10-29T17:22:20Z","modified":"2026-10-29T19:45:49.861385894Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793292439","title":"TuxCare security update for body-parser (1 CVE)","description":"TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.14.2-tuxcare.5.","status":"published","published":"2026-10-29T17:47:21Z","modified":"2026-10-29T19:45:51.317762066Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"openSUSE-SU-2026:12424-1","title":"agama-web-ui-25+475.275dd4727-56.1 on GA media","description":"These are all security issues fixed in the agama-web-ui-25+475.275dd4727-56.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:11.345171291Z","updated_at":"2026-11-06T18:05:03.243497Z"},{"id":"openSUSE-SU-2026:12429-1","title":"git-bug-0.11.0-4.1 on GA media","description":"These are all security issues fixed in the git-bug-0.11.0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-05T00:00:00Z","modified":"2026-11-06T17:23:11.628955542Z","updated_at":"2026-11-06T18:05:03.243497Z"}]}}