{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-9FF4F1EF",
  "slug": "cve-2026-111181-body-parser-compressed-body-dos",
  "title": "One gzipped POST crashes Express via body-parser before routing (CVE-2026-111181)",
  "aliases": [
    "CVE-2026-111181",
    "GHSA-27r3-jxmh-p828",
    "body-parser compressed body DoS",
    "body-parser trailing bytes DoS",
    "Express body-parser uncaught exception"
  ],
  "summary": "CVE-2026-111181 / GHSA-27r3-jxmh-p828 is a high-severity denial of service in the npm package body-parser. When a request carries Content-Encoding (gzip, deflate, or on 2.x Brotli), body-parser pipes the body into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that Node raises as an uncaught exception, terminating the process. Parsing runs before routing, so no authentication and no matching route are required. Fixed in body-parser 1.20.9 and 2.4.0. Express 4.22.3 declares body-parser ~1.20.5 and Express 5.3.0 declares ^2.3.0, so updating express alone does not pull the patched versions when the lockfile is pinned. Workaround: pass inflate: false to reject encoded bodies before a decoder is created. Same-day sibling multer CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a separate DoS for asynchronous fileFilter, fixed in multer 2.5.0.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "No in-the-wild exploitation reported and not in CISA KEV as of 2026-10-22. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) comes from the GHSA; NVD analysis may lag. Express has not yet shipped a release that bumps the body-parser dependency range.",
  "firstObservedAt": "2026-10-22T11:39:52Z",
  "lastObservedAt": "2026-10-22T14:49:42Z",
  "publishedAt": "2026-10-22T14:53:32.756Z",
  "reviewedAt": "2026-10-22T14:53:27.147Z",
  "expiresAt": "2026-10-22T14:49:42Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ghsa-body-parser",
      "label": "GHSA-27r3-jxmh-p828: body-parser trailing bytes after compressed body",
      "url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-22T11:39:52Z"
    },
    {
      "id": "release-2-4-0",
      "label": "body-parser 2.4.0 release notes",
      "url": "https://github.com/expressjs/body-parser/releases/tag/v2.4.0",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-22T11:36:33Z"
    },
    {
      "id": "release-1-20-9",
      "label": "body-parser 1.20.9 release notes",
      "url": "https://github.com/expressjs/body-parser/releases/tag/1.20.9",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-22T11:33:51Z"
    },
    {
      "id": "ghsa-multer",
      "label": "GHSA-q7qp-rjg7-q26m: multer async fileFilter DoS (CVE-2026-113872)",
      "url": "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-10-22T11:59:00Z"
    },
    {
      "id": "cve-record",
      "label": "CVE-2026-111181 record",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-111181",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-10-22T00:00:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL blog: body-parser CVE-2026-111181 operator write-up",
      "url": "https://hol.org/blog/cve-2026-111181-body-parser-compressed-body-dos",
      "sourceType": "other_primary",
      "observedAt": "2026-10-22T14:49:42Z"
    }
  ],
  "artifacts": [
    {
      "id": "body-parser-npm",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "body-parser",
      "version": "<1.20.9 || >=2.0.0 <2.4.0",
      "defanged": false
    },
    {
      "id": "multer-npm",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "multer",
      "version": ">=2.0.0 <2.5.0 (sibling CVE-2026-113872)",
      "defanged": false
    }
  ],
  "indicators": [
    {
      "id": "pkg-body-parser",
      "indicatorType": "package_name",
      "value": "body-parser",
      "defanged": false,
      "confidence": "high"
    }
  ],
  "timeline": [
    {
      "id": "ghsa-published",
      "occurredAt": "2026-10-22T11:39:52Z",
      "eventType": "disclosure",
      "summary": "Express publishes GHSA-27r3-jxmh-p828 / CVE-2026-111181 for body-parser compressed-body trailing-bytes DoS; patches 1.20.9 and 2.4.0 on npm.",
      "sourceIds": [
        "ghsa-body-parser",
        "release-2-4-0",
        "release-1-20-9"
      ]
    },
    {
      "id": "multer-sibling",
      "occurredAt": "2026-10-22T11:59:00Z",
      "eventType": "disclosure",
      "summary": "Same-day multer GHSA-q7qp-rjg7-q26m / CVE-2026-113872 async fileFilter DoS fixed in 2.5.0.",
      "sourceIds": [
        "ghsa-multer"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-10-22T14:49:42Z",
      "eventType": "other",
      "summary": "HOL Guard publishes operator write-up and security campaign for CVE-2026-111181.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "hol-guard-agent-pause",
      "relationship": "not_covered",
      "limitation": "HOL Guard pauses risky AI-agent actions on developer machines; it does not patch body-parser or filter Content-Encoding on production Express servers. The fix is the package upgrade."
    }
  ],
  "policies": [
    {
      "policyId": "upgrade-body-parser",
      "purpose": "Bump body-parser to a patched release and redeploy",
      "status": "available",
      "limitation": "Requires a deploy of the application image or serverless bundle; Express dependency ranges alone do not guarantee the bump."
    },
    {
      "policyId": "inflate-false-workaround",
      "purpose": "Reject compressed request bodies until redeploy",
      "status": "available",
      "limitation": "Breaks legitimate clients that send Content-Encoding; outbound fetch of compressed responses is unrelated."
    }
  ],
  "limitations": [
    "Not remote code execution and not a confidentiality/integrity issue; impact is availability (process crash).",
    "Apps that already pass inflate: false are not exposed.",
    "Stacks that never mount body-parser (Fastify, Koa, Hono, raw http) are out of scope for this CVE.",
    "multer CVE-2026-113872 is a sibling package; a body-parser bump does not fix uploads."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-111181-body-parser-compressed-body-dos/corrections"
}