SB2026102502 - Uncaught Exception in body-parser

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102502

SB2026102502 - Uncaught Exception in body-parser

Published: October 25, 2026

Security Bulletin ID SB2026102502
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Uncaught Exception (CVE-ID: CVE-2026-111181)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service by terminating the application process.

The vulnerability exists due to an uncaught exception in body-parser's request decompression handling when processing trailing bytes after a valid compressed request body. A remote attacker can send a single request containing a valid compressed frame followed by trailing bytes to trigger an error in the already-finished decoder, which remains piped without an error listener, and terminate the application process.

The request does not need to match an application route because body parsing runs before routing.


Remediation

Install update from vendor's website.

References