CVE-2026-45705: Out-of-bounds Read

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CLSA-2026-1784596302 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.2...

CLSA-2026-1784596340 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.0-tuxcare.1...

CLSA-2026-1782262677 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.1-tuxcare.1...

CLSA-2026-1782262678 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.20.2-tuxcare.1...

CLSA-2026-1782262676 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.19.0-tuxcare.1...

CLSA-2026-1774225187 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.13.3-tuxcare.1...

CLSA-2026-1773793044 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.8.4-tuxcare.1...

CLSA-2026-1772583201 TuxCare security update for body-parser (1 CVE)

TuxCare rebuilt body-parser to address 1 CVE. Fixed in 1.14.2-tuxcare.1...

CVE-2026-66730

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66730: Loop with Unreachable Exit Condition

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress gua...

CVE-2026-66729: Out-of-bounds Read

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32t wraparound ...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @appium/base-driver (>=10.0.0-rc.2, <=10.7.1) +179 more potentially affected by CVE-2026-12590 via body-parser (>=2.0.0-beta.1, <=2.2.2)

body-parser NPM version =2.0.0-beta.1, =0.3.1, =10.0.0-rc.2, =3.2.0, =4.2.0, =1.0.0, =2.0.32, =1.4.0, =1.1.1, =1.0.15, =1.0.15, =1.0.1-beta.1, =9.1.1-ruixiang.1, =9.0.0, =3.0.10, =3.8.8, =3.9.1 and more Source cves: CVE-2026-12590 Source advisory: OSV:GHSA-V422-HMWV-36X6...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +18979 more potentially affected by CVE-2026-12590 via body-parser (>=1.0.0, <=1.20.5)

body-parser NPM version =1.0.0, =1.0.0, =0.2.0, =1.0.2, =2.0.0, =0.2.0, =0.0.978, =0.2.0, =0.0.1, =0.0.28, =0.0.36 and more Source cves: CVE-2026-12590 Source advisory: OSV:GHSA-V422-HMWV-36X6...

EUVD-2026-42577

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement...

GHSA-V422-HMWV-36X6 body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

NPM: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement vulnerability discovered by ? in WordPress Npm body-parser versions 1.20.6...

body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept...

SUSE CVE-2026-12590

Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as thei...

Linux Distros Unpatched Vulnerability : CVE-2026-12590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Impact: In body-parser versions prior to 1.20.6 1.x line and 2.3.0 2.x line, when the parser is configured with an invalid limit option value such as an...