Cloudanix VulnDB

CVE-2026-111181

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A specially crafted web request can instantly shut down any application that uses a common Node.js component for reading incoming data, causing downtime until the service is manually restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

A single HTTP request with valid gzip-compressed body plus trailing bytes causes body-parser to finish the decompression stream without an error listener; the subsequent decoder error is emitted as an uncaught exception that terminates the Node.js process.

Why it matters to the business

Any service using body-parser with default settings can be taken offline by a single unauthenticated request, resulting in immediate loss of availability for all users until the process is restarted.

How an attack unfolds

An attacker sends one request containing a correctly compressed frame followed by extra bytes after the end of the stream. Body parsing occurs before routing, the valid frame is accepted, the response is sent, and the trailing bytes trigger an unhandled error that crashes the worker.

How to fix it

Upgrade body-parser to 1.20.9 or 2.4.0 (or later). As an immediate mitigation set the inflate option to false on all body-parser middleware instances.

How to confirm the fix worked

After upgrade, send a test request containing a valid compressed frame plus trailing garbage and confirm the process remains running and returns the expected error status instead of crashing.

Typical attack path

  1. Identify any endpoint that accepts POST/PUT/PATCH with a body
  2. Craft a gzip payload ending with a valid frame plus additional bytes
  3. Send the request with Content-Encoding: gzip
  4. Observe the process termination and service outage

How to detect it

Monitor Node.js process logs and stderr for uncaught exceptions originating from zlib or decompression streams immediately after a body-parser request; correlate with HTTP access logs showing Content-Encoding: gzip requests that produced 200 responses followed by abrupt worker death.

What your security team should do

  • Apply the version upgrade or set inflate:false within 24 hours given public disclosure
  • Add process-level uncaughtException and unhandledRejection handlers that log and restart cleanly
  • Review all Express routes that use body parsing and ensure they are covered by the fix

The record

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No matching route is required because body parsing runs before routing, so any endpoint that parses a body is affected. The issue is fixed in body-parser 2.4.0 and 1.20.9, and users should upgrade to one of those versions or later. As a workaround, disable request-body inflation (set the body-parser inflate option to false) so encoded requests are rejected before any decompression stream is created.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities