Packages

body-parser

2.4.0 · 22 Oct 2026MIT201.6M / weekRepositoryHomepagenpmAtom feed

Upgrading body-parser From 1.6.5 to 2.4.0

61 releases in betweenevery note read

Other targets from 1.6.5Newest 1.x, Clears its 3 advisories1.20.9
  1. 1.6.5yours
  2. 21 releases
  3. 1.13.0breaking
  4. 30 releases
  5. 2.0.0major
  6. 2 releases
  7. 2.1.0breaking
  8. 1 release
  9. 2.2.1security
  10. 1 release
  11. 2.3.0security
  12. 2.4.0target
5
changes to make
3
advisories fixed
18
new
15
fixes

Before you upgrade

Tick each one off as you go
  • breaking2.1.0
  • breaking2.1.0
  • breaking2.0.0
  • breaking2.0.0
  • breaking1.13.0

Security

Fixes 3 advisories affecting 1.6.5

Release by release

  1. 2.4.0

    Security fix22 Oct 20263 new · 1 fix
    • security

      Security fix for CVE-2026-111181 (GHSA-27r3-jxmh-p828)

    • new

      json: Avoid first-char regex for direct JSON bodies

    • new

      Zstandard support

    • new

      Inline content stream setup

    • fixed

      Avoid mutating read options when reading body

  2. 2.3.0

    Security fix15 Jun 20262 new · 1 fix
    • security

      Security fix for CVE-2026-12590 (GHSA-v422-hmwv-36x6)

    • new

      urlencoded: Move empty-body guard to avoid extra function closure

    • new

      Eliminate conditional check in json strict mode hot path

    • fixed

      Improve limit option validation

  3. 2.2.2nothing new or fixed in the note

  4. 2.2.1

    Security fix24 Nov 20251 new

  5. 2.2.0

    27 Mar 20251 fix
    • fixed

      Remove skip of test

  6. 2.1.0

    Migration needed10 Feb 20252 new · 2 fixes
    • breaking

      Update package.json engines field to reflect minimum supported node version

    • breaking

      Remove unpipe package and use native unpipe method

    • new

      Use the node require cache instead of custom caching

    • new

      Add caret for body-parser dependencies

    • fixed

      Remove brotli support check

    • fixed

      Remove obsolete dependency destroy

  7. 2.0.2nothing new or fixed in the note

  8. 2.0.1

    10 Sep 20241 fix
    • fixed

      Fix defaulting to extended url parsing

30 other lines we could not sort, mostly version bumps

  • Improve ESM compatibility

    2.3.0

  • Upgrade "content-type"

    2.3.0

  • Update outdated reference to MDN docs

    2.3.0

  • Remove history.md from being packaged on publish

    2.2.1

  • dep: Upgrade iconv-lite to ^0.6.3

    2.2.0

  • Refactor parameterCount to optimize performance

    2.2.0

  • Release 2.2.0

    2.2.0

  • Remove unused devDependency methods

    2.1.0

  • Remove devDependency safe-buffer

    2.1.0

  • cleanup: Remove obsolete test env file

    2.1.0

222 internal lines (docs, tests, tooling) left out.