Denial of Service in body-parser Due to Invalid Limit Handling

Executive Summary

CVE-2026-12590 affects the body-parser npm package and occurs when the parser is configured with an invalid limit option value such as an unparseable string or NaN. In affected versions, this causes bytes.parse() to return null, which silently disables the request body size check.

As a result, applications relying on the limit option to prevent oversized request bodies will accept arbitrarily large payloads. This can lead to excessive memory and CPU usage, causing a denial of service (DoS).

The vulnerability impacts body-parser versions prior to 1.20.6 (1.x line) and prior to 2.3.0 (2.x line). It has been fixed by making invalid limit values throw a clear error during parser construction instead of silently disabling enforcement.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to denial of service (DoS) attacks by allowing attackers to send arbitrarily large request bodies to applications using vulnerable versions of body-parser.

Because the size check is silently skipped when an invalid limit is set, the application may consume excessive memory and CPU resources, potentially causing it to become unresponsive or crash.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when the body-parser package is configured with an invalid limit option value such as an unparseable string or NaN, causing the size check to be skipped silently.

To detect this vulnerability on your system, you should check the version of the body-parser package in use and verify the configuration of the limit option.

• Run a command to check the installed version of body-parser, for example: npm list body-parser
• Inspect your application configuration files or code to find the limit option passed to body-parser and verify if it is a valid, parseable value.
• You can add logging or debugging around the body-parser initialization to detect if an invalid limit value is being used.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade body-parser to version 1.20.6 or later if you are using the 1.x line, or to version 2.3.0 or later if you are using the 2.x line.

Additionally, validate the limit option value before passing it to body-parser to ensure it is a valid, finite number.

• Parse the limit value at application startup using bytes.parse() or equivalent and reject any configuration where the result is null or non-finite.
• If upgrading immediately is not possible, implement validation checks on the limit configuration to prevent invalid values from disabling size enforcement.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability in body-parser allows denial of service (DoS) attacks by accepting arbitrarily large payloads when an invalid limit value is configured. While the impact is limited to availability (excessive memory and CPU usage), it does not directly involve data confidentiality or integrity.

Because the vulnerability primarily affects availability and does not expose or compromise personal data, it does not directly violate compliance requirements of standards like GDPR or HIPAA, which focus on data protection and privacy.

However, denial of service incidents can indirectly impact compliance by causing service outages or disruptions, which may affect availability requirements under these regulations.

Useful 0 Not Useful 0