CVE-2026-111181

The body-parser middleware for Node.js and Express is vulnerable to a Denial of Service (DoS) attack in versions before 1.20.9 and 2.0.0 before 2.4.0 . When a request uses Content-Encoding (e.g., gzip ), the middleware pipes data into a decompression stream but fails to attach an error listener. ...

CVE-2026-111181

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

CVE-2026-111181 body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell — CVE-2026-109618 Pre-auth use-after-free in PHP...

PT-2026-134928

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

PT-2026-121403

Name of the Vulnerable Software and Affected Versions body-parser versions prior to 1.20.9 body-parser versions 2.0.0 through 2.3.x Description An issue exists where a single request can crash an application using default options. When a request uses a Content-Encoding like gzip, the software pip...

PT-2026-134931

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a...

Improper exception handling vulnerability in expressjs body-parser

Versions of expressjs body-parser prior to 1.20.9 and from 2.0.0 up to but not including 2.4.0 contain an improper exception handling vulnerability. This vulnerability arises when a request containing Content-Encoding is pipelined into an decompression stream; after reading the request body, this...

PT-2026-134583

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.2...

CLSA-2026-1792476566 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.1...

PT-2026-133374

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.18.2-tuxcare.1...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in body-parser

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in body-parser. CVE-2026-12590 This has been addressed. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when t...

Security Bulletin: IBM Maximo Application Suite uses body-parser-1.20.5.tgz which is vulnerable to CVE-2026-12590

Summary IBM Maximo Application Suite uses body-parser-1.20.5.tgz which is vulnerable to CVE-2026-12590. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-12590 DESCRIPTION: Impact: In body-parser versions prior to 1.20.6 1.x line...

CVE-2026-110816

Summary "qs.stringify" with "arrayFormat: 'comma'" throws "TypeError: Cannot convert object to primitive value" when an array element cannot be coerced to a string, such as an object with an own non-callable "toString" " "toString": "x" " or a null-prototype object. The comma format joins array...

CVE-2026-108545

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

CVE-2026-108545

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

EUVD-2026-96340

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

CVE-2026-108545 SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing

SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 50...

CVE-2026-108545

SillyTavern versions 1.12.13 through 1.19.0 are vulnerable to a pre-authentication Denial of Service (DoS) . The root cause is that body-parser middleware executes before authentication and whitelist checks, allowing unauthenticated remote attackers to submit large or compressed JSON or urlencode...