body-parser

Important: Security

• security

  Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

What's Changed

• Avoid mutating read options when reading body

• json: Avoid first-char regex for direct JSON bodies

• Zstandard support

• Inline content stream setup

Important: Security

• security

  Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

What's Changed

• urlencoded: Move empty-body guard to avoid extra function closure

• Improve ESM compatibility

• Improve limit option validation

• Eliminate conditional check in json strict mode hot path

• Upgrade "content-type"

• Update outdated reference to MDN docs

Important: Security

• security

  Security fix for CVE-2025-13466 (GHSA-wqch-xfxh-vrr4)

What's Changed

• Move read options outside parser middlewares

• Remove history.md from being packaged on publish

What's Changed

• Remove skip of test

• dep: Upgrade iconv-lite to ^0.6.3

• Refactor parameterCount to optimize performance

• Release 2.2.0

What's Changed

• breaking

  Update package.json engines field to reflect minimum supported node version

• Remove brotli support check

• removed

  Remove unpipe package and use native unpipe method

• Remove unused devDependency methods

• Remove devDependency safe-buffer

• Use the node require cache instead of custom caching

• Remove obsolete dependency destroy

• cleanup: Remove obsolete test env file

• Refactor decompression stream creation to remove code duplication

• Add caret for body-parser dependencies

• Release v2.1.0

What's Changed

• breaking

  Update package.json engines field to reflect minimum supported node version

• Remove brotli support check

• removed

  Remove unpipe package and use native unpipe method

• Remove unused devDependency methods

What's Changed

• Fix defaulting to extended url parsing

What's Changed

Important

• Add brotli support #406

• breaking

  Node.js 18 is the minimum supported version

Details

• Pin to node@22.4.1

• removed

  Drop support for less than LTS node versions in v2

• Also use the qs module for the simple parser

• urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities

• Added support for brotli ('br') content-encoding

• Add OSSF Scorecard badge

• Linter

Important: Security

• security

  Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

Important

Same code base as 1.20.7. This was created to test the new release process.

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@6.14.2+. (#716)

• Correct off-by-one error in parameterCount

What's Changed

• Remove redundant depth check

What's Changed

Important

• Add depth option to customize the depth level in the parser

• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

• Pin to node@22.4.1

• Add OSSF Scorecard badge

• Linter

• Fix issue where invalid charset results in 400 when verify used

• Fix JSON strict parse error to match syntax errors

• Provide static require analysis in urlencoded parser

• Add statusCode property on Errors, in addition to status

• Change type default to application/json for JSON parser

• Change type default to application/x-www-form-urlencoded for urlencoded parser

• Provide static require analysis

• Use the http-errors module to generate errors

• Enable strict mode

• removed

  Remove argument reassignment

• Remove delete call

• Slight efficiency improvement when not debugging

• Add debug messages

• Accept a function for the type option

• Use content-type to parse Content-Type headers

• Make internal extended: true depth limit infinity