---
title: "GHSA-v422-hmwv-36x6: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement"
description: "Low severity. body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement. Affects body-parser; fixed in 2.3.0."
url: https://inlinr.com/advisories/GHSA-v422-hmwv-36x6
lang: en
---

[Packages](https://inlinr.com/packages) / [body-parser](https://inlinr.com/packages/body-parser) / [Security](https://inlinr.com/packages/body-parser/security)

Low Vulnerability GHSA-v422-hmwv-36x6 CVE-2026-12590 Published 20 Jul 2026

# body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Your version 

Affected releases · [body-parser](https://inlinr.com/packages/body-parser)

- 2.x 2.0.0 – 2.2.2 Fixed in 2.3.0
- 1.x 1.0.0 – 1.20.5 Fixed in 1.20.6

On 2.x, the newest line:

```
npm install body-parser@2.3.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.2.2  
7 releases
2. Fixed

2.3.0 – 2.4.0  
2 releases, latest

1.x 

1. Affected

1.0.0 – 1.20.5  
73 releases
2. Fixed

1.20.6 – 1.20.9  
3 releases

85 stable releases of body-parser, oldest to newest, one row per major.

## What happens

Impact

When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.

This issue affects applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first.

Patches

This issue is fixed in [body-parser@2.3.0](https://github.com/expressjs/body-parser/releases/tag/v2.3.0 "https://github.com/expressjs/body-parser/releases/tag/v2.3.0") and [body-parser@1.20.6](https://github.com/expressjs/body-parser/releases/tag/v1.20.6 "https://github.com/expressjs/body-parser/releases/tag/v1.20.6") via [#698](https://github.com/expressjs/body-parser/pull/698 "https://github.com/expressjs/body-parser/pull/698"). After the fix, invalid `limit` values throw a clear error at parser construction time instead of silently disabling enforcement. `null` and `undefined` continue to fall back to the default limit (`100kb`).

Workarounds

Validate `limit` before passing it to body-parser. For example, parse the value with [bytes.parse()](https://github.com/visionmedia/bytes.js "https://github.com/visionmedia/bytes.js") at startup and reject any configuration where it returns `null` or a non-finite number.

References

- [#698](https://github.com/expressjs/body-parser/pull/698 "https://github.com/expressjs/body-parser/pull/698"): fix PR
- [bytes.js](https://github.com/visionmedia/bytes.js "https://github.com/visionmedia/bytes.js"): limit parser

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6 "https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6")  
github.com/expressjs/body-parser/security/advis…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-12590 "https://nvd.nist.gov/vuln/detail/CVE-2026-12590")  
nvd.nist.gov/vuln/detail/CVE-2026-12590
- [Pull request](https://github.com/expressjs/body-parser/pull/698 "https://github.com/expressjs/body-parser/pull/698")  
#698
- [Pull request](https://github.com/expressjs/body-parser/pull/741 "https://github.com/expressjs/body-parser/pull/741")  
#741
- [Fix commit](https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d "https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d")  
2322e11
- [Fix commit](https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac "https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac")  
3492672
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/body-parser "https://github.com/expressjs/body-parser")  
github.com/expressjs/body-parser
- [Reference](https://github.com/expressjs/body-parser/releases/tag/1.20.6 "https://github.com/expressjs/body-parser/releases/tag/1.20.6")  
github.com/expressjs/body-parser/releases/tag/1…
- [Reference](https://github.com/expressjs/body-parser/releases/tag/v2.3.0 "https://github.com/expressjs/body-parser/releases/tag/v2.3.0")  
github.com/expressjs/body-parser/releases/tag/v…