body-parser
2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed
Upgrading body-parser From 1.16.0 to 1.20.9
20 releases in betweenevery note read
- 0
- changes to make
- 3
- advisories fixed
- 2
- new
- 7
- fixes
Security
Fixes 3 advisories affecting 1.16.0
- body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodyhigh · GHSA-27r3-jxmh-p828
- body-parser vulnerable to denial of service when url encoding is enabledhigh · GHSA-qwcr-r2fm-qrc7
- body-parser vulnerable to denial of service when invalid limit value silently disables size enforcementlow · GHSA-v422-hmwv-36x6
- 1.20.9
Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)
- 1.20.6
Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)
Release by release
- security
Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)
- security
1.20.8nothing new or fixed in the note
- security
Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)
- fixed
Improve limit option validation
- security
- fixed
Correct off-by-one error in parameterCount
- fixed
1.20.4nothing new or fixed in the note
- new
Add
depthoption to customize the depth level in the parser - new
Add OSSF Scorecard badge
- fixed
Pin to node@22.4.1
- new
- fixed
Fix strict json error message on Node.js 19+
- fixed
1.20.1nothing new or fixed in the note
2 other lines we could not sort, mostly version bumps
- 1.20.4
Remove redundant depth check
- 1.20.3
IMPORTANT: The default
depthlevel for parsing URL-encoded data is now32(previously wasInfinity). Documentation
29 internal lines (docs, tests, tooling) left out.