CVE-2026-12590: body-parser DoS Vulnerability

CVE-2026-12590 Overview

CVE-2026-12590 affects the body-parser middleware for Node.js, widely used in Express.js applications to parse incoming HTTP request bodies. The vulnerability exists in versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line). When developers configure the parser with an invalid limit option, such as an unparseable string or NaN, the internal bytes.parse function returns null and the request body size check is silently skipped. Applications that rely on limit as their primary defense against oversized payloads accept arbitrarily large request bodies. The flaw is tracked under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Attackers can send arbitrarily large HTTP request bodies to misconfigured applications, driving excessive memory and CPU consumption that results in denial of service.

Affected Products

body-parser versions prior to 1.20.6 in the 1.x release line
body-parser versions prior to 2.3.0 in the 2.x release line
Express.js applications and downstream frameworks that embed vulnerable body-parser releases

Discovery Timeline

2026-07-09 - CVE-2026-12590 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-12590

Vulnerability Analysis

The body-parser middleware exposes a limit option that developers set to cap the maximum accepted request body size. Internally, body-parser delegates parsing of that option to the bytes library through bytes.parse. When bytes.parse receives a value it cannot interpret, such as an arbitrary string or NaN, it returns null.

The pre-patch code path treats a null result as "no limit configured" rather than as an error. The size enforcement branch is skipped and the middleware streams the full request body into memory. An attacker who can reach an endpoint protected only by a misconfigured limit can transmit oversized payloads until the Node.js process exhausts memory or CPU. The result is degraded service or a full process crash.

Root Cause

The root cause is missing input validation on the limit configuration value. body-parser conflated two distinct return states from bytes.parse: a legitimate absence of configuration (null/undefined falling back to the 100kb default) and an invalid configuration value (unparseable string or NaN). Both cases disabled enforcement, so a typo or bad environment variable silently removed the size cap.

Attack Vector

Exploitation requires that a target application already run with an invalid limit value in its body-parser configuration. The attacker does not need authentication or user interaction. Once such an application is exposed, the adversary sends HTTP requests with very large bodies to any route handled by the misconfigured parser. Because the size check never executes, the server continues buffering data, consuming heap memory and blocking the event loop.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-v422-hmwv-36x6.

Detection Methods for CVE-2026-12590

Indicators of Compromise

Sustained spikes in Node.js process resident memory correlated with inbound HTTP POST, PUT, or PATCH traffic
HTTP requests with Content-Length values or chunked payloads far exceeding documented API limits
Repeated 5xx responses, event loop lag warnings, or process restarts on services that use body-parser

Detection Strategies

Inventory Node.js dependencies with npm ls body-parser or software composition analysis to flag versions below 1.20.6 and 2.3.0
Scan application configuration and environment variables for non-numeric limit values passed to bodyParser.json, bodyParser.urlencoded, or bodyParser.raw
Instrument reverse proxies to log and alert on request bodies exceeding expected API sizes

Monitoring Recommendations

Track heap usage, garbage collection pauses, and event loop delay metrics for Node.js services behind Express
Monitor web server access logs for anomalous request body sizes per endpoint and per client IP
Alert on repeated large-payload requests originating from a single source, which may indicate resource exhaustion attempts

How to Mitigate CVE-2026-12590

Immediate Actions Required

Upgrade body-parser to 1.20.6 on the 1.x line or 2.3.0 on the 2.x line
Audit all body-parser initialization sites and confirm limit values resolve to a finite number of bytes
Rebuild and redeploy transitive dependents, including Express-based frameworks that vendor body-parser

Patch Information

The issue is fixed in body-parser1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement. null and undefined continue to fall back to the default limit of 100kb. Details are published in the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-v422-hmwv-36x6.

Workarounds

Validate the limit value at application startup by parsing it and rejecting any configuration where the result is null or a non-finite number
Enforce a maximum request body size at an upstream reverse proxy or API gateway so parser misconfiguration cannot expose the origin
Restrict large-body endpoints with authentication and rate limiting until the upgrade is deployed

bash

# Upgrade body-parser to a patched release
npm install body-parser@^1.20.6   # for the 1.x line
npm install body-parser@^2.3.0    # for the 2.x line

# Verify no vulnerable versions remain in the dependency tree
npm ls body-parser