From 7f6c30742e4209062f48472bdd442c84b5893f55 Mon Sep 17 00:00:00 2001 From: Mayvis Date: Wed, 22 Jul 2026 15:12:03 +0800 Subject: [PATCH] deps: bump body-parser to ^2.3.0 to fix CVE-2026-12590 body-parser < 2.3.0 silently disables request body size enforcement when given an invalid `limit` option value (bytes.parse() returns null), allowing a denial of service via arbitrarily large payloads (CVE-2026-12590 / GHSA-v422-hmwv-36x6). 2.3.0 throws on invalid `limit` values at parser initialization instead of failing open. Co-Authored-By: Claude Opus 4.8 --- History.md | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/History.md b/History.md index 8a4293ab547..a00fc1f2de6 100644 --- a/History.md +++ b/History.md @@ -44,6 +44,8 @@ // after -> Content-Disposition: attachment; filename=user.html ``` +* Upgrade `body-parser` to `^2.3.0`, which fixes [CVE-2026-12590](https://www.cve.org/CVERecord?id=CVE-2026-12590) ([GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)): an invalid `limit` option value caused request body size enforcement to be silently disabled (fail-open), allowing a denial of service via arbitrarily large payloads. Invalid `limit` values now throw at parser initialization instead of being ignored + ## ⚡ Performance * Avoid duplicate Content-Type header processing in `res.send()` when sending string responses without an explicit Content-Type header - by [@bjohansebas](https://github.com/bjohansebas) in [#6991](https://github.com/expressjs/express/pull/6991) diff --git a/package.json b/package.json index 80bff0ad8a4..bd091eb68d5 100644 --- a/package.json +++ b/package.json @@ -33,7 +33,7 @@ ], "dependencies": { "accepts": "^2.0.0", - "body-parser": "^2.2.1", + "body-parser": "^2.3.0", "content-disposition": "^2.0.1", "content-type": "^2.0.0", "cookie": "^0.7.1",