GHSA-wqch-xfxh-vrr4
Medium · 5.3CVSS
5.3
EPSS
—
Published
Nov 25, 2025
CISA due date
—
The record
body-parser is vulnerable to denial of service when url encoding is used
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | body-parser | 2.2.0 | No fix |
| Chainguard | code-server | 0 | 4.106.2-r1 |
| Chainguard | code-server-compat | 0 | 4.106.2-r1 |
| Chainguard | kibana-9.2 | 0 | 9.2.1-r2 |
| Chainguard | kibana-9.2-iamguarded | 0 | 9.2.1-r2 |
| Chainguard | langfuse | 0 | 3.134.0-r1 |
| Chainguard | langfuse-compat | 0 | 3.134.0-r1 |
| Chainguard | langfuse-worker | 0 | 3.134.0-r1 |
| Chainguard | librechat | 0 | 0.8.1-r0 |
| Chainguard | librechat-compat | 0 | 0.8.0-r4 |
| Chainguard | librechat-dev | 0 | 0.8.0-r4 |
| Chainguard | opensearch-dashboards-2 | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-compat | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-config | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-alerting-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-config | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-maps | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-notifications | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-observability | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-query-workbench | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-reporting | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-search-relevance | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-dashboards-visualizations | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-index-management-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-ml-commons-dashboards | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-security-analytics-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-fips-security-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r2 |
| Chainguard | redisinsight | 0 | 2.70.1-r5 |
| Chainguard | redisinsight-docker-entrypoint | 0 | 2.70.1-r5 |
| Chainguard | saf | 0 | 1.5.2-r0 |
| Chainguard | tileserver-gl | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-compat | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-fips | 0 | 5.4.0-r5 |
| Chainguard | tileserver-gl-fips-compat | 0 | 5.4.0-r5 |
| Wolfi | code-server | 0 | 4.106.2-r1 |
| Wolfi | code-server-compat | 0 | 4.106.2-r1 |
| Wolfi | langfuse | 0 | 3.134.0-r1 |
| Wolfi | langfuse-compat | 0 | 3.134.0-r1 |
| Wolfi | langfuse-worker | 0 | 3.134.0-r1 |
| Wolfi | opensearch-dashboards-2 | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-alerting-dashboards-plugin | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-anomaly-detection-dashboards-plugin | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-compat | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-config | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-maps | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-notifications | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-observability | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-query-workbench | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-reporting | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-search-relevance | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-dashboards-visualizations | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-index-management-dashboards-plugin | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-ml-commons-dashboards | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-security-analytics-dashboards-plugin | 0 | 2.19.4-r2 |
| Wolfi | opensearch-dashboards-2-security-dashboards-plugin | 0 | 2.19.4-r2 |
| Wolfi | saf | 0 | 1.5.2-r0 |
| Wolfi | tileserver-gl | 0 | 5.4.0-r5 |
| Wolfi | tileserver-gl-compat | 0 | 5.4.0-r5 |
Related vulnerabilities
- CVE-2025-13466 body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of… Same vulnerability
- CVE-2024-45590 body-parser is Node.js body parsing middleware. Also affects body-parser
- GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names Also affects code-server
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects code-server
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Also affects code-server
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects code-server
- GHSA-27v5-c462-wpq7 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards Also affects code-server
- GHSA-j3q9-mxjg-w52f path-to-regexp vulnerable to Denial of Service via sequential optional groups Also affects code-server