ThinkFacility Sign in
  1. Home
  2. Security
  3. npm package (body-parser)
Highnpm package (body-parser)

body-parser before 1.20.9 and 2.4.0: one compressed request can crash a Node.js app

Anyone running a Node.js server built on Express or body-parser with the default options.

How to fix it

You haveUpdate to
2.0.0 and later, before 2.4.0→2.4.0before 1.20.9→1.20.9

Check your version

Which version your project has
npm ls body-parser

Update

In your project
npm update body-parser
npm ls body-parser
Still old? A dependency pins it
npm explain body-parser
Then check what's left
npm audit

If you can't update yet

If your app doesn't need compressed request bodies, pass inflate: false to body-parser. Encoded requests then get rejected before any decompression starts.

If npm ls still shows an old version under another package, update that package, or add an "overrides" entry for this one in package.json.

Sources