body-parser — CVE history (npm)
body-parser
3 CVEs affect the body-parser npm package (highest CVSS 7.5). Latest disclosed: 2026-07-09. Full CVE history sourced from NVD.
Summary
- Package
body-parser(npm)- Total CVEs
3- Actively exploited (CISA KEV)
- 0
- Highest CVSS
7.5- Latest disclosed
- 2026-07-09
Recent CVEs (top 3)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-12590 | Low | 3.7 | — | 2026-07-09 | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size chec… |
CVE-2025-13466 | — | — | — | 2025-11-24 | body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. |
CVE-2024-45590 | High | 7.5 | — | 2024-09-10 | body-parser is Node.js body parsing middleware. |
All-time worst (top 2 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2024-45590 | High | 7.5 | — | 2024-09-10 | body-parser is Node.js body parsing middleware. |
CVE-2026-12590 | Low | 3.7 | — | 2026-07-09 | Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size chec… |