Uncaught Exception in body-parser - CVE-2026-111181
Published: October 25, 2026
Vulnerability identifier: #VU157643
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-111181
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating the application process.
The vulnerability exists due to an uncaught exception in body-parser's request decompression handling when processing trailing bytes after a valid compressed request body. A remote attacker can send a single request containing a valid compressed frame followed by trailing bytes to trigger an error in the already-finished decoder, which remains piped without an error listener, and terminate the application process.
The request does not need to match an application route because body parsing runs before routing.
Affected software
body-parser
How to mitigate CVE-2026-111181
Install security update from vendor's website.
body-parser - addressed in versions 1.20.9, 2.4.0