---
title: "body-parser security advisories"
description: "4 known security advisories for body-parser, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/body-parser/security
lang: en
---

[Packages](https://inlinr.com/packages)

# body-parser

2.4.0 · 22 Oct 2026 MIT 201.6M / week [Repository](https://github.com/expressjs/body-parser) [Homepage](https://github.com/expressjs/body-parser#readme) [npm](https://www.npmjs.com/package/body-parser) [Atom feed](https://inlinr.com/packages/feed/body-parser)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands  |
| ---- | ------ | ---------------- |
|      | 2.4.0  | Safe from 2.4.0  |
|      | 1.20.9 | Safe from 1.20.9 |

- High  
[body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body](https://inlinr.com/advisories/GHSA-27r3-jxmh-p828)GHSA-27r3-jxmh-p828 · 23 Oct 2026  
fixed in 2.4.0, 1.20.9
- High  
[body-parser vulnerable to denial of service when url encoding is enabled](https://inlinr.com/advisories/GHSA-qwcr-r2fm-qrc7)GHSA-qwcr-r2fm-qrc7 · 10 Sep 2024  
fixed in 1.20.3
- Moderate  
[body-parser is vulnerable to denial of service when url encoding is used](https://inlinr.com/advisories/GHSA-wqch-xfxh-vrr4)GHSA-wqch-xfxh-vrr4 · 25 Nov 2025  
fixed in 2.2.1
- Low  
[body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement](https://inlinr.com/advisories/GHSA-v422-hmwv-36x6)GHSA-v422-hmwv-36x6 · 20 Jul 2026  
fixed in 2.3.0, 1.20.6

### Quality and security signals

What [npm](https://www.npmjs.com/package/body-parser) and [deps.dev](https://deps.dev/npm/body-parser) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.