Hi,

The following vulnerability was published for node-body-parser.

CVE-2026-111181[0]:
| body-parser is body parsing middleware for Node.js and Express. In
| versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a
| single request can crash any application using body-parser with
| default options. When a request carries a Content-Encoding such as
| gzip, body-parser pipes it into a decompression stream and, after
| reading the body, leaves that stream with no error listener. A
| payload of one valid compressed frame followed by trailing bytes
| decodes and the application responds normally, but the trailing
| bytes then reach the already-finished decoder, which emits an error
| that is re-thrown as an uncaught exception and terminates the
| process. No matching route is required because body parsing runs
| before routing, so any endpoint that parses a body is affected. The
| issue is fixed in body-parser 2.4.0 and 1.20.9, and users should
| upgrade to one of those versions or later. As a workaround, disable
| request-body inflation (set the body-parser inflate option to false)
| so encoded requests are rejected before any decompression stream is
| created.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-111181
https://www.cve.org/CVERecord?id=CVE-2026-111181
[1] https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Hello,

Bug #1151838 in node-body-parser reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-body-parser/-/commit/d60499e2d065e9bcb06ace7438959caac92d1eb8

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151838

Hello,

Bug #1151838 in node-body-parser reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/js-team/node-body-parser/-/commit/d60499e2d065e9bcb06ace7438959caac92d1eb8

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1151838

We believe that the bug you reported is fixed in the latest version of
node-body-parser, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151838@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Xavier Guimard <yadd@debian.org> (supplier of updated node-body-parser package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 23 Oct 2026 22:51:32 +0200
Source: node-body-parser
Architecture: source
Version: 2.4.0+~1.19.6-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
Changed-By: Xavier Guimard <yadd@debian.org>
Closes: 1151838
Changes:
 node-body-parser (2.4.0+~1.19.6-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream version (Closes: #1151838, CVE-2026-111181)
Checksums-Sha1:
 a8496b6518e5fcc3a6379511612832d7243e4db9 2747 node-body-parser_2.4.0+~1.19.6-1.dsc
 1859bebb8fd7dac9918a45d54c1971ab8b5af474 2945 node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
 5fcbd056373221ade97d296a534046a83e7fa955 32926 node-body-parser_2.4.0+~1.19.6.orig.tar.gz
 3405a8df21c945a430b18eba1a9ffb85f6501f0d 3936 node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
Checksums-Sha256:
 36a5b281b137ce2e8fca15329464760f273de06a2d440208434ca3f8dbaf0e8e 2747 node-body-parser_2.4.0+~1.19.6-1.dsc
 640c729c03c2527aca389e1e134d342a5ccee6b394b700e297141f580fe89f8a 2945 node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
 49e3e2623c2cff5e255cab76b6398455970be7fcb46a528902244d112df3faec 32926 node-body-parser_2.4.0+~1.19.6.orig.tar.gz
 8b2e5030453433dff5d404e84fc0cffb881c87e744d8af456b473183014d95cc 3936 node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
Files:
 bc01d4d95638385f1c4f4d24f302f309 2747 javascript optional node-body-parser_2.4.0+~1.19.6-1.dsc
 ecea4b2ead546efcfaa132b3bdf8c290 2945 javascript optional node-body-parser_2.4.0+~1.19.6.orig-types-body-parser.tar.gz
 3cdf6a75ce5cd83074752cb08f33cb63 32926 javascript optional node-body-parser_2.4.0+~1.19.6.orig.tar.gz
 1d6d36abe9d1774f68dedca313011671 3936 javascript optional node-body-parser_2.4.0+~1.19.6-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrbyTYACgkQ9tdMp8mZ
7unFzg//Uxvvd7TC7X+IePezdZCIK6MZC563lMrKeK+r+kBrQbZOGTYReFEwaEzA
EjfwujR/wgG2OyHixOps3TOjtBO1Qv9/Cvml/AiKd/JAvvNaqKJJ7Q3EwveufGNM
AGccO+TAL89mWWdNkhA039yz6NIP+Wv/rEBjxlzLHjvM7fzoOI9Ug4mtx4LgKqut
iPulFICSvWGDm3LBtJiXk1gNQLXy7J8zRpgNzUrhQavnCKmwFhxVze28wz6RssnL
VRYzmRF0NZNRaLQv/Q12XXXQxcY4mZifOJEgzJ/PXn5wy1IHVFxczcW5iLWiwoyk
NKZBhlUeSFLXHo63R1sa8YSZFawJoho6oRUsHX6k9FJyBVZJJZC3pXS8QroYJpjF
Bb7yVZGCw2cipkUkQdosKb6fvOoGXJyhhLJw/iD6ogKOfZeu8dLpTy2C2ANz9IfB
PL9Vd9e9Cj7EJ7qbM/ITEy8x8b/vJsfuHhFRcGWEle49QRxkjvVLp5l/HCcCZ48O
c/i1ad/QEIawi44NqGX03Lxmyz28WcAsELwWLwsR0+fWnf+YJuJv0DBmBdkYxEWS
OD6Ld9m+zgIGUAHcRMcnN4iC/UW3NSK+LqWBz3Fk/R0VcOa5HIaddZYoWNDP6ESx
9zI4zMQeVZRfrXeC4hdwDUCjyhFzI1mEZYSuxbiaRwST86dAs9g=
=yDLn
-----END PGP SIGNATURE-----