body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
Your version
1.20.9 is the newest release of 1.x.
In short
1 fixed
Security
3 advisories affect 1.20.0; 1.20.9 fixes them
- Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-27r3-jxmh-p828 · 23 Oct 2026Fixed in 1.20.9
- Highbody-parser vulnerable to denial of service when url encoding is enabledGHSA-qwcr-r2fm-qrc7 · 10 Sep 2024Fixed in 1.20.3
- Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-v422-hmwv-36x6 · 20 Jul 2026Fixed in 1.20.6
Release note
Fix error message for json parse whitespace in
strictFix internal error when inflated body exceeds limit
Prevent loss of async hooks context
Prevent hanging when request already read
deps: depd@2.0.0
Replace internal
evalusage withFunctionconstructorUse instance methods on
processto check for listeners
deps: http-errors@2.0.0
deps: depd@2.0.0
deps: statuses@2.0.1
deps: on-finished@2.4.1
deps: qs@6.10.3
deps: raw-body@2.5.1
deps: http-errors@2.0.0