CVE-2026-111181: Express.js body-parser denial of service via decompression stream

CVE-2026-111181 · Severity: high · CVSS 7.5 · Published 2026-10-22

body-parser is middleware used by Node.js and Express applications to parse incoming request bodies. A malicious request with a Content-Encoding header (such as gzip) and specially crafted trailing bytes can crash any application using body-parser with its default settings, causing a denial of service. This affects all endpoints that parse request bodies, regardless of whether they require authentication or a matching route.

Technologies: Body-Parser. Vendors: Express.js.

Quick answers

Is CVE-2026-111181 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111181 being exploited in the wild.
How severe is CVE-2026-111181?
High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?
Express.js Body-Parser < 1.20.9 and >= 2.0.0, < 2.4.0; Body-Parser >= 2.0.0, < 2.4.0, SEMVER:introduced=2.0.0,fixed=2.4.0.
Is there a fix for CVE-2026-111181?
Yes. Body-Parser: upgrade to 2.4.0 or later. Until then: Set the inflate option to false when initializing body-parser middleware to reject encoded requests before any decompression stream is created, if the application does not need to accept compressed request bodies. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111181 attacked?
It is attacked over the network.
Am I affected by CVE-2026-111181?
Check whether you run Express.js Body-Parser or Body-Parser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Body-Parser: upgrade to 2.4.0 or later

Set the inflate option to false when initializing body-parser middleware to reject encoded requests before any decompression stream is created, if the application does not need to accept compressed request bodies.

Technical details

The vulnerability stems from improper error handling in decompression stream processing. When a request carries a Content-Encoding, body-parser pipes it into a decompression stream but leaves that stream without an error listener. A payload of one valid compressed frame followed by trailing bytes triggers the stream to emit an unhandled error upon encountering the trailing bytes, resulting in an uncaught exception that terminates the process. The attack requires only network access and no authentication; the vulnerability is triggered before routing occurs.

Affected products

  • Express.js body-parser < 1.20.9 and >= 2.0.0, < 2.4.0

Identifiers

  • CVE-2026-111181
  • GHSA-27r3-jxmh-p828

Timeline

  • 2026-10-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.