In node-body-parser versions before 1.20.6 (1.x) and 2.3.0 (2.x), if the parser is configured with an invalid limit option (e.g., unparseable string or NaN), the internal bytes.parse function returns null, causing the request body size check to be skipped silently. This allows applications relying on the limit option to accept arbitrarily large payloads, resulting in excessive resource consumption and potential denial of service. The vulnerability is addressed in body-parser 1.20.6 and 2.3.0 by throwing an error on invalid limit values during parser construction, while null or undefined limits fall back to the default 100kb. A workaround is to validate the limit value before passing it to body-parser.

Applications using affected versions of node-body-parser with an invalid limit configuration may accept arbitrarily large HTTP request bodies, leading to excessive memory and CPU usage and denial of service conditions. There is no impact on confidentiality or integrity, only availability is affected.

This vulnerability is fixed in node-body-parser versions 1.20.6 and 2.3.0. Users should upgrade to these or later versions. Additionally, validate the limit option value before passing it to body-parser to ensure it is parseable and finite. Invalid limit values should be rejected at application startup to prevent silent bypass of size checks.