high severityConfidence highHistorical record

One gzipped POST crashes Express via body-parser before routing (CVE-2026-111181)

Direct answer

One gzipped POST crashes Express via body-parser before routing (CVE-2026-111181), also tracked as CVE-2026-111181 / GHSA-27r3-jxmh-p828 / body-parser compressed body DoS is a high-severity threat campaign HOL Guard tracked from Oct 22, 2026 to Oct 22, 2026, verified against 6 primary sources and last reviewed Oct 22, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-111181 / GHSA-27r3-jxmh-p828 is a high-severity denial of service in the npm package body-parser. When a request carries Content-Encoding (gzip, deflate, or on 2.x Brotli), body-parser pipes the body into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that Node raises as an uncaught exception, terminating the process. Parsing runs before routing, so no authentication and no matching route are required. Fixed in body-parser 1.20.9 and 2.4.0. Express 4.22.3 declares body-parser ~1.20.5 and Express 5.3.0 declares ^2.3.0, so updating express alone does not pull the patched versions when the lockfile is pinned. Workaround: pass inflate: false to reject encoded bodies before a decoder is created. Same-day sibling multer CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a separate DoS for asynchronous fileFilter, fixed in multer 2.5.0.

Also tracked as CVE-2026-111181 · GHSA-27r3-jxmh-p828 · body-parser compressed body DoS · body-parser trailing bytes DoS · Express body-parser uncaught exception

First observed
Oct 22, 2026
Last observed
Oct 22, 2026
Last reviewed
Oct 22, 2026
Tracking ended
Oct 22, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

No in-the-wild exploitation reported and not in CISA KEV as of 2026-10-22. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) comes from the GHSA; NVD analysis may lag. Express has not yet shipped a release that bumps the body-parser dependency range.

  • Not remote code execution and not a confidentiality/integrity issue; impact is availability (process crash).
  • Apps that already pass inflate: false are not exposed.
  • Stacks that never mount body-parser (Fastify, Koa, Hono, raw http) are out of scope for this CVE.
  • multer CVE-2026-113872 is a sibling package; a body-parser bump does not fix uploads.

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard pauses risky AI-agent actions on developer machines; it does not patch body-parser or filter Content-Encoding on production Express servers. The fix is the package upgrade.

  • Recipe available

    Bump body-parser to a patched release and redeploy

    Requires a deploy of the application image or serverless bundle; Express dependency ranges alone do not guarantee the bump.

  • Recipe available

    Reject compressed request bodies until redeploy

    Breaks legitimate clients that send Content-Encoding; outbound fetch of compressed responses is unrelated.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    Express publishes GHSA-27r3-jxmh-p828 / CVE-2026-111181 for body-parser compressed-body trailing-bytes DoS; patches 1.20.9 and 2.4.0 on npm.

    Sources:GHSA-27r3-jxmh-p828: body-parser trailing bytes after compressed body·body-parser 2.4.0 release notes·body-parser 1.20.9 release notes

  2. Disclosure

    Same-day multer GHSA-q7qp-rjg7-q26m / CVE-2026-113872 async fileFilter DoS fixed in 2.5.0.

    Source:GHSA-q7qp-rjg7-q26m: multer async fileFilter DoS (CVE-2026-113872)

  3. Update

    HOL Guard publishes operator write-up and security campaign for CVE-2026-111181.

    Source:HOL blog: body-parser CVE-2026-111181 operator write-up

Publication clock: 3.2 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • body-parser@<1.20.9 || >=2.0.0 <2.4.0npmpackage
  • multer@>=2.0.0 <2.5.0 (sibling CVE-2026-113872)npmpackage

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

1 indicator is recorded as not defanged. Treat it as live.

  • package namehigh confidencenot defanged
    body-parser

Sources

Every claim on this record is traceable to the sources below.

Campaign questions, answered

CVE-2026-111181 / GHSA-27r3-jxmh-p828 is a high-severity denial of service in the npm package body-parser. When a request carries Content-Encoding (gzip, deflate, or on HOL Guard tracked the campaign from Oct 22, 2026 to Oct 22, 2026.

No. Active tracking ended Oct 22, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 6 primary sources, names 2 reviewed artifacts, and was last fully reviewed Oct 22, 2026 by HOL Guard Security Publishing. 1 of its 1 indicators is recorded as not defanged and should be treated as live. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage. The campaign-specific policy starting point is linked from the coverage section of this record.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. No in-the-wild exploitation reported and not in CISA KEV as of 2026-10-22. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) comes from the GHSA; NVD analysis may lag.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-9FF4F1EF