body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
Your version
2.4.0 is the newest release of 2.x.
In short
1 breaking1 removed4 new1 fixed2 changed5 internal
- breaking
Node.js 18 is the minimum supported version
- removed
Drop support for less than LTS node versions in v2
Security
2 advisories affect 2.0.0; 2.4.0 fixes them
- Highbody-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyGHSA-27r3-jxmh-p828 · 23 Oct 2026Fixed in 2.4.0
- Lowbody-parser vulnerable to denial of service when invalid limit value silently disables size enforcementGHSA-v422-hmwv-36x6 · 20 Jul 2026Fixed in 2.3.0
Release note
What's Changed
Important
Add brotli support #406
- breaking
Node.js 18 is the minimum supported version
Details
Pin to node@22.4.1
- removed
Drop support for less than LTS node versions in v2
Also use the qs module for the simple parser
urlencoded: Support iso-8859-1, utf8 sentinel, and numeric entities
Added support for brotli ('br') content-encoding
Add OSSF Scorecard badge
Linter