body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
Your version
1.20.9 is the newest release of 1.x.
In short
2 deprecated3 new4 changed1 internal
- deprecated
Deprecate
bodyParser()middleware; use.json()and.urlencoded()as needed - deprecated
Deprecate
urlencoded()without providedextendedoption
Security
3 advisories affect 1.4.0; 1.20.9 fixes them
- Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-27r3-jxmh-p828 · 23 Oct 2026Fixed in 1.20.9
- Highbody-parser vulnerable to denial of service when url encoding is enabledGHSA-qwcr-r2fm-qrc7 · 10 Sep 2024Fixed in 1.20.3
- Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-v422-hmwv-36x6 · 20 Jul 2026Fixed in 1.20.6
Release note
Add
textparserAdd
rawparserCheck accepted charset in content-type (accepts utf-8)
Check accepted encoding in content-encoding (accepts identity)
- deprecated
Deprecate
bodyParser()middleware; use.json()and.urlencoded()as needed - deprecated
Deprecate
urlencoded()without providedextendedoption lazy-load urlencoded parsers
Parsers split into files for reduced mem usage
Support gzip and deflate bodies
set
inflate: falseto turn off