body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
Affects Microsoft Security Response Center MicrosoftSource GCVE Database
Not known to be exploited.
Data as of 10/25/2026, 12:18:08 UTC
Rated by Threat Radar · CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
npmbody-parserpkg:npm/body-parserOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a fix is available, consider limiting exposure to untrusted compressed request bodies or applying network-level protections to mitigate potential DoS attempts.
Description
A vulnerability identified as CVE-2026-111181 affects the body-parser component version 3.0, allowing a Denial of Service (DoS) attack via trailing bytes after a compressed request body. The issue relates to improper handling of compressed request bodies that contain extra trailing bytes, which can be exploited to disrupt service availability.
Impact
The impact of this vulnerability is a Denial of Service, which can cause the affected service to become unavailable or unresponsive when processing specially crafted compressed request bodies containing trailing bytes. There is no indication of remote code execution or data disclosure.
Weaknesses
- CWE-248Uncaught Exception (opens in a new tab)
Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)
An exception is thrown from a function, but it is not caught.