{"type":"bundle","id":"bundle--e8481dce-a37c-5e36-a5e7-ae3198a9daed","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--bb43e6eb-543d-544c-902a-c0b86a32ae4f","created":"2026-10-22T14:53:32.756Z","modified":"2026-10-22T14:53:32.756Z","name":"One gzipped POST crashes Express via body-parser before routing (CVE-2026-111181)","description":"CVE-2026-111181 / GHSA-27r3-jxmh-p828 is a high-severity denial of service in the npm package body-parser. When a request carries Content-Encoding (gzip, deflate, or on 2.x Brotli), body-parser pipes the body into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that Node raises as an uncaught exception, terminating the process. Parsing runs before routing, so no authentication and no matching route are required. Fixed in body-parser 1.20.9 and 2.4.0. Express 4.22.3 declares body-parser ~1.20.5 and Express 5.3.0 declares ^2.3.0, so updating express alone does not pull the patched versions when the lockfile is pinned. Workaround: pass inflate: false to reject encoded bodies before a decoder is created. Same-day sibling multer CVE-2026-113872 (GHSA-q7qp-rjg7-q26m) is a separate DoS for asynchronous fileFilter, fixed in multer 2.5.0.","aliases":["CVE-2026-111181","GHSA-27r3-jxmh-p828","body-parser compressed body DoS","body-parser trailing bytes DoS","Express body-parser uncaught exception"],"first_seen":"2026-10-22T11:39:52Z","last_seen":"2026-10-22T14:49:42Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GHSA-27r3-jxmh-p828: body-parser trailing bytes after compressed body","url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"},{"source_name":"body-parser 2.4.0 release notes","url":"https://github.com/expressjs/body-parser/releases/tag/v2.4.0"},{"source_name":"body-parser 1.20.9 release notes","url":"https://github.com/expressjs/body-parser/releases/tag/1.20.9"},{"source_name":"GHSA-q7qp-rjg7-q26m: multer async fileFilter DoS (CVE-2026-113872)","url":"https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"},{"source_name":"CVE-2026-111181 record","url":"https://www.cve.org/CVERecord?id=CVE-2026-111181"},{"source_name":"HOL blog: body-parser CVE-2026-111181 operator write-up","url":"https://hol.org/blog/cve-2026-111181-body-parser-compressed-body-dos"}]}]}