Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-111181— body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

Quick assessment

Affected
body-parser body-parser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

body-parser 是用于 Node.js 和 Express 的请求体解析中间件。在 1.20.9 之前的版本，以及 2.0.0 至 2.4.0 之间的版本中，单个请求即可导致任何使用 body-parser 默认配置的应用程序崩溃。当请求携带如 gzip 之类的 Content-Encoding 头时，body-parser 会将其内容管道传输至一个解压缩流；在读取完请求体后，该解压缩流未设置错误监听器。若攻击者发送一个由“一个有效的压缩帧 + 后续尾随字节”组成的载荷，body-parser 会先正常解码

CVSS 7.5 · High EPSS 0.37% · P29

Affected Version Matrix 4

VendorProduct Version RangeStatus
body-parser body-parser 2.0.0< 2.4.0 affected
2.4.0 unaffected
< 1.20.9 affected
1.20.9 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-111181

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
Source: CVE Program / CVE List V5
Vulnerability Description
body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
body-parser body-parser 2.0.0 ~ 2.4.0 -

II. Public POCs for CVE-2026-111181

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-111181

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-111181 (1)

IV. Related Vulnerabilities

Same product: body-parser
Same vendor: body-parser
Same weakness: CWE-248

V. Comments for CVE-2026-111181

No comments yet

Leave a comment