---
title: "body-parser 2.4.0"
description: "Latest published version of body-parser is 2.4.0, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/body-parser
lang: en
---

[Packages](https://inlinr.com/packages)

# body-parser

2.4.0 · 22 Oct 2026 MIT 201.6M / week [Repository](https://github.com/expressjs/body-parser) [Homepage](https://github.com/expressjs/body-parser#readme) [npm](https://www.npmjs.com/package/body-parser) [Atom feed](https://inlinr.com/packages/feed/body-parser)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/body-parser/upgrade)

LineNewestSecurity

- 2.x 2.4.0 Safe from 2.4.0 Latest line
- 1.x 1.20.9 Safe from 1.20.9 [To 2.4.0](https://inlinr.com/packages/body-parser/upgrade/1.20.9-2.4.0)

## What to use instead

## A better maintained package

From the [e18e module-replacements](https://github.com/es-tooling/module-replacements) list, maintained by the community.

The list compares the options for body-parser: [read the comparison](https://github.com/es-tooling/module-replacements/blob/main/docs/modules/body-parser.md).

## Before you switch

1. 1  
Check what else depends on it  
Paste your package.json in the [dependency check](https://inlinr.com/tools/dependency-check) to see every deprecated or outdated package in one pass, not only this one.
2. 2  
Read the replacement's peers and releases  
A native API or a few lines of code need no release notes, but check the Node version your project runs on.
3. 3  
Know when it ships  
Follow the new package on inlinr: its releases and advisories land in your feed, and the time spent on the migration branch shows on its page.

## Latest releases

[All 85 releases](https://inlinr.com/packages/body-parser/releases)

1. 2.x · latest line
2. ### [2.4.0](https://inlinr.com/packages/body-parser/releases/2.4.0 "Open this release") [](https://github.com/expressjs/body-parser/releases/tag/v2.4.0 "Read this release where it was published")  
22 Oct 2026

  - security  
  Security fix for [CVE-2026-111181](https://www.cve.org/CVERecord?id=CVE-2026-111181 "https://www.cve.org/CVERecord?id=CVE-2026-111181") ([GHSA-27r3-jxmh-p828](https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828 "https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"))
  - Avoid mutating read options when reading body
  - **json:** Avoid first-char regex for direct JSON bodies
3. ### [2.3.0](https://inlinr.com/packages/body-parser/releases/2.3.0 "Open this release") [](https://github.com/expressjs/body-parser/releases/tag/v2.3.0 "Read this release where it was published")  
15 Jun 2026

  - security  
  Security fix for [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2025-13466 "https://www.cve.org/CVERecord?id=CVE-2025-13466") ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6 "https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"))
  - **urlencoded:** Move empty-body guard to avoid extra function closure
  - Improve ESM compatibility
4. ### [2.2.2](https://inlinr.com/packages/body-parser/releases/2.2.2 "Open this release") [](https://github.com/expressjs/body-parser/releases/tag/v2.2.2 "Read this release where it was published")  
7 Jan 2026  
Maintenance only: docs, tests, build or refactoring. Nothing changes in how you use it.

Dependency tracking · free for 3 projects

## Know when your own dependencies move

body-parser had 3 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[All 4](https://inlinr.com/packages/body-parser/security)

- [body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body](https://inlinr.com/advisories/GHSA-27r3-jxmh-p828) High · fixed in 2.4.0, 1.20.9
- [body-parser vulnerable to denial of service when url encoding is enabled](https://inlinr.com/advisories/GHSA-qwcr-r2fm-qrc7) High · fixed in 1.20.3
- [body-parser is vulnerable to denial of service when url encoding is used](https://inlinr.com/advisories/GHSA-wqch-xfxh-vrr4) Moderate · fixed in 2.2.1

## Health

[Details](https://inlinr.com/packages/body-parser/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.