Express
4 articles
BreakingCVE
One gzipped POST crashes Express via body-parser CVE-2026-111181. Upgrade to 1.20.9 or 2.4.0
How to fix CVE-2026-111181: upgrade body-parser to 1.20.9 or 2.4.0. Trailing bytes after a compressed request body crash the Node process before routing runs.
HOL Guard
BreakingCVE
Node.js CVE-2026-111497 lets one malformed Brotli body corrupt memory through fetch(), Express 5 and zlib
How to fix CVE-2026-111497: upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1. A malformed Brotli stream makes the bundled decoder write past a buffer, and fetch(), Express 5 body parsing and zlib all reach it.
HOL Guard
CVEMulter
Aborted multer uploads still fill the disk after the 5038 fix
How to fix CVE-2026-88932: upgrade multer to 2.4.0
HOL Guard
CVECompression
CVE-2026-87776: Express compression leaks native memory until the process dies
How to fix CVE-2026-87776: upgrade compression to 1.8.2
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.