---
title: "GHSA-qwcr-r2fm-qrc7: body-parser vulnerable to denial of service when url encoding is enabled"
description: "High severity. body-parser vulnerable to denial of service when url encoding is enabled. Affects body-parser; fixed in 1.20.3."
url: https://inlinr.com/advisories/GHSA-qwcr-r2fm-qrc7
lang: en
---

[Packages](https://inlinr.com/packages) / [body-parser](https://inlinr.com/packages/body-parser) / [Security](https://inlinr.com/packages/body-parser/security)

High Vulnerability GHSA-qwcr-r2fm-qrc7 CVE-2024-45590 Published 10 Sep 2024

# body-parser vulnerable to denial of service when url encoding is enabled

Your version 

Affected releases · [body-parser](https://inlinr.com/packages/body-parser)

- 1.x 1.0.0 – 1.20.2 Fixed in 1.20.3

On 1.x, the newest line:

```
npm install body-parser@1.20.3
```

Every release on a timeline

2.x 

1. Not affected

2.0.0 – 2.4.0  
9 releases, latest

1.x 

1. Affected

1.0.0 – 1.20.2  
70 releases
2. Fixed

1.20.3 – 1.20.9  
6 releases

85 stable releases of body-parser, oldest to newest, one row per major.

## What happens

Impact

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

Patches

this issue is patched in 1.20.3

References

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7 "https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7")  
github.com/expressjs/body-parser/security/advis…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-45590 "https://nvd.nist.gov/vuln/detail/CVE-2024-45590")  
nvd.nist.gov/vuln/detail/CVE-2024-45590
- [Fix commit](https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce "https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce")  
b2695c4
- [Package](https://github.com/expressjs/body-parser "https://github.com/expressjs/body-parser")  
github.com/expressjs/body-parser