CVE-2026-12590: CVE-2026-12590: Fail-Open Limit Enforcement Vulnerability in body-parser

CVE-2026-12590: Fail-Open Limit Enforcement Vulnerability in body-parser

Vulnerability ID: CVE-2026-12590
CVSS Score: 3.7
Published: 2026-07-20

A vulnerability in the 'body-parser' Node.js middleware allows unauthenticated attackers to trigger a Denial of Service. When the 'limit' configuration option is misconfigured with an unparseable type or empty value, size limits fail open. This leads to unrestricted heap memory allocation and process crash via Out of Memory (OOM).

TL;DR

Unparseable limit configurations in the body-parser middleware fail open silently. Attackers can exploit this to send massive requests, exhausting server memory and crashing the Node.js process.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-770
• Attack Vector: Network (AV:N)
• CVSS v3.1: 3.7 (Low)
• EPSS Score: 0.0025 (Percentile: 16.43%)
• Exploit Status: PoC-only
• CISA KEV Status: Not Listed

Affected Systems

• Applications utilizing Express.js with body-parser
• Node.js software packages with body-parser dependencies prior to 1.20.6
• Node.js software packages with body-parser dependencies starting at 2.0.0 and prior to 2.3.0
• body-parser: < 1.20.6 (Fixed in: 1.20.6)
• body-parser: >= 2.0.0 < 2.3.0 (Fixed in: 2.3.0)

Code Analysis

Commit: 2322e11

Correct core limit normalization and input validation within utils file

Commit: 3492672

Apply corrected validation checks to specific JSON, raw, text, and URL-encoded parsers

Mitigation Strategies

• Upgrade the body-parser dependency to secure versions 1.20.6+ or 2.3.0+
• Validate environment variables and configuration inputs before passing them to the middleware initialization block
• Implement network-level request body size limits in reverse proxies or API gateways

Remediation Steps:

1. Scan the project dependencies using 'npm audit' or 'yarn audit' to identify vulnerable body-parser installations
2. Update package.json dependencies to require body-parser >= 1.20.6 or body-parser >= 2.3.0
3. Run 'npm install' or 'yarn install' to pull the patched dependency versions
4. Review initialization parameters for body-parser and replace dynamic configuration patterns with validated, deterministic values
5. Deploy the updated application and monitor start logs for validation errors during initialization

References

• GitHub Security Advisory: body-parser Denial of Service vulnerability
• OpenJS Foundation Security Advisories
• NVD - CVE-2026-12590 Detailed Report
• CVE-2026-12590 Record

---

Read the full report for CVE-2026-12590 on our website for more details including interactive diagrams and full exploit analysis.