CVE-2026-12590: body-parser Silent Limit Bypass Denial of Service

Technical summary

The vulnerability stems from body-parser's handling of the limit configuration parameter. When bytes.parse() is called with an invalid limit value, it returns null. The current code does not distinguish between a legitimate null return (indicating no limit should be enforced) and a null return caused by parsing failure. As a result, the request body size check is completely bypassed. The fix, implemented in versions 1.20.6 and 2.3.0, introduces validation that throws an error during parser initialization if the limit value is invalid, making the misconfiguration explicit and discoverable at startup rather than in production. Legitimate null and undefined values continue to fall back to the default 100 KB limit.

Business impact

This vulnerability enables denial-of-service attacks through resource exhaustion. An attacker can send extremely large request payloads to an affected application, causing memory and CPU to spike uncontrollably. In multi-tenant or shared infrastructure environments, this can degrade service for all users. The risk is particularly acute for applications exposed to the public internet or untrusted networks. However, the impact depends critically on whether the application was misconfigured with an invalid limit value; properly configured applications are unaffected.

Affected systems

This vulnerability affects Node.js applications using body-parser middleware versions prior to 1.20.6 (1.x series) or 2.3.0 (2.x series). Only deployments where the limit configuration option has been set to an invalid value (an unparseable string, NaN, or similar) are actually vulnerable. Applications using default configurations or explicitly setting limit to a valid number or omitting it entirely are not at risk.

Exploitability

Exploitation requires that an application has already misconfigured body-parser with an invalid limit parameter value. An attacker would then craft and send abnormally large POST or PUT requests to trigger resource exhaustion. This is straightforward to execute once misconfiguration is present, but the vulnerability is not remotely triggerable in applications with correct configuration. The CVSS score of 3.7 (LOW) reflects the requirement for a specific, atypical misconfiguration and the availability impact without confidentiality or integrity loss.

Remediation

Update body-parser to version 1.20.6 or later (1.x line) or version 2.3.0 or later (2.x line). These versions will surface any invalid limit configuration as an error at parser initialization, preventing silent failures. After upgrading, verify that your application's limit configuration is either omitted (to use the 100 KB default), set to null or undefined, or set to a valid numeric value. Perform a test deployment to catch any misconfiguration before production use.

Patch guidance

Upgrade body-parser dependency in your package.json or package-lock.json to version 1.20.6 or higher (if using 1.x) or 2.3.0 or higher (if using 2.x). Run npm update or yarn upgrade and test thoroughly in a non-production environment. Pay particular attention to your startup logs and configuration validation—the new version will emit clear errors if limit values are malformed. If you are currently on an unsupported version, plan the upgrade promptly. Verify against the official Express.js and body-parser release notes for any breaking changes or additional migration guidance.

Detection guidance

Search your codebase and configuration files for any instance where body-parser's limit option is set to a non-numeric value, NaN, or any value that bytes.parse() cannot handle. Review configuration management systems, environment variable parsing, and all initialization code. If you are unable to patch immediately, implement input validation on any limit configuration before it is passed to body-parser, and log warnings if invalid values are detected. Monitor request sizes and resource usage for anomalous spikes that might indicate exploitation attempts.

Why prioritize this

Although rated LOW severity, this vulnerability merits prompt attention for organizations using body-parser because: (1) the fix is simple and non-breaking for correctly configured deployments, (2) misconfiguration can be difficult to spot and may already exist in production, and (3) denial-of-service impact, while not critical, directly affects availability. Prioritize patching after inventory of which applications use body-parser and verification of their current configuration.

Risk score, explained

The CVSS 3.1 score of 3.7 reflects a LOW severity rating because the vulnerability requires both a network vector and a specific, atypical misconfiguration to be exploited. The impact is limited to availability (memory and CPU exhaustion), with no confidentiality or integrity compromise. The attack complexity is considered high because it depends on the target application being misconfigured rather than on a flaw that affects all users. However, the ease of exploitation once misconfiguration is present prevents the score from being lower.

Frequently asked questions