Executive brief
body-parser is a middleware library used in Node.js web applications to parse incoming HTTP request bodies. Versions prior to 1.20.3 are vulnerable to denial of service attacks when URL encoding is enabled. An attacker can send specially crafted requests to overwhelm the server, causing it to become unresponsive and disrupting service availability for legitimate users.
Technical details
This is an asymmetric resource consumption vulnerability (CWE-405) in the URL encoding handler of body-parser. When URL encoding is enabled, a malicious actor can craft payloads that cause the parser to consume excessive computational resources or time, leading to denial of service. The vulnerability is network-accessible, requires no authentication or user interaction, and can be exploited remotely by sending a specially crafted request. The issue has been patched in version 1.20.3, and users should upgrade immediately.
Affected products
- Express.js body-parser <1.20.3
Timeline
- 2024-09-10: disclosed
- 2024-09-10: patched: Fixed in version 1.20.3