October 2026 Security Releases

The Express team has released body-parser 2.4.0 and 1.20.9, and multer 2.5.0, addressing two denial-of-service vulnerabilities in request body parsing and multipart upload handling. We also want to address an upstream Brotli decoder vulnerability that affects applications accepting Brotli-compressed request bodies.

npm update body-parser multer

The following vulnerabilities have been addressed:

• CVE-2026-111181 in body-parser middleware (High)
• CVE-2026-113872 in multer middleware (High)

CVE-2026-111181 in body-parser middleware (High)

body-parser versions >= 2.0.0, < 2.4.0 and < 1.20.9 are vulnerable to denial of service through trailing bytes after a compressed request body

body-parser decompresses request bodies by default. A request body made of a valid gzip member followed by trailing bytes decodes successfully and the application responds normally, but the trailing bytes then reach the already-finished decompression stream, which emits an error. Because no error listener remains except the one Node’s pipe() adds, the error becomes an uncaught exception and crashes the process. A single unauthenticated request is enough, and no matching route or authentication is required because parsing runs before routing. The fix in 2.4.0 and 1.20.9 handles the stream error instead of letting it propagate.

Affected versions: >= 2.0.0, < 2.4.0 and < 1.20.9
Patched version: >= 2.4.0 and >= 1.20.9

For more details, see GHSA-27r3-jxmh-p828.

CVE-2026-113872 in multer middleware (High)

multer versions >= 2.0.0, < 2.5.0 are vulnerable to denial of service through a pending asynchronous fileFilter after request teardown

multer runs a user-supplied fileFilter for each uploaded file. When fileFilter is asynchronous and a request is aborted, for example when one file is rejected, while another file’s filter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled exception that exits the process. A single unauthenticated request is enough, and any application using an asynchronous fileFilter is affected regardless of storage engine. Uploads using a synchronous fileFilter are not affected. The fix in 2.5.0 stops a pending asynchronous fileFilter from acting on a stream after the request has been torn down.

Affected versions: >= 2.0.0, < 2.5.0
Patched version: >= 2.5.0

For more details, see GHSA-q7qp-rjg7-q26m.

A note on Brotli decompression (CVE-2026-111497)

Google recently published CVE-2026-111497, an out-of-bounds write in the Brotli decoder, which raised community concern about its impact on the Express ecosystem. Node.js bundles this decoder, and Express applications that accept Brotli-compressed request bodies reach it: with default options, express.json(), express.urlencoded(), and the other body parsers decompress a Content-Encoding: br request body through Node’s zlib.createBrotliDecompress().

As the Express project, our recommendation is to upgrade Node.js to a release that ships the patched Brotli decoder. That is the real fix. Only if you cannot upgrade Node for some reason, and your application does not need Brotli-compressed request bodies, use a workaround like the following to reject them at the edge before any body parser runs:

// Register before every body parser or decompression middleware.
app.use((req, res, next) => {
  const encoding = (req.get('Content-Encoding') || 'identity').trim().toLowerCase();

  if (!['identity', 'gzip', 'deflate'].includes(encoding)) {
    return res.status(415).send('Use gzip, deflate, or an uncompressed request body.');
  }
  next();
});

// Keep your existing parser options and register routes afterward.
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

Thanks to Patch the Planet for reporting the impact on the Express ecosystem and for the write-up and workaround.

We recommend upgrading to the latest versions of body-parser and multer, and keeping your Node.js runtime up to date, to secure your applications.