body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
1.20.9 is the newest release of 1.x.
In short
1 fixed
Security
3 advisories affect 1.18.0; 1.20.9 fixes them
- Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-27r3-jxmh-p828 · 23 Oct 2026Fixed in 1.20.9
- Highbody-parser vulnerable to denial of service when url encoding is enabledGHSA-qwcr-r2fm-qrc7 · 10 Sep 2024Fixed in 1.20.3
- Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-v422-hmwv-36x6 · 20 Jul 2026Fixed in 1.20.6
Release note
Fix JSON strict violation error to match native parse error
Include the
bodyproperty on verify errorsInclude the
typeproperty on all generated errorsUse
http-errorsto set status code on errorsdeps: bytes@3.0.0
deps: debug@2.6.8
deps: depd@~1.1.1
Remove unnecessary
Bufferloading
deps: http-errors@~1.6.2
deps: depd@1.1.1
deps: iconv-lite@0.4.18
Add support for React Native
Add a warning if not loaded as utf-8
Fix CESU-8 decoding in Node.js 8
Improve speed of ISO-8859-1 encoding
deps: qs@6.5.0
deps: raw-body@2.3.1
Use
http-errorsfor standard emitted errorsdeps: bytes@3.0.0
deps: iconv-lite@0.4.18
perf: skip buffer decoding on overage chunk
perf: prevent internal
throwwhen missing charset