CVE-2026-111181

About vulnerability

Impact

A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.

Patches

Fixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.

Workarounds

Pass inflate: false to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.

Affected product:

@mcp-ui/client , @mcp-ui/server , AngularJS , CopilotKit/CopilotKit , Express , React , TanStack/ai , Vue , a2a-js , a2a-js-sdk , adk-js , adobe-design-data-agent-mcp , adobe-design-data-mcp , adobe-spectrum-design-data-mcp , ag-ui , ag-ui-aws-strands , agents , ai-sdk-harness-cline , ai-sdk-harness-pi , ai-sdk-provider-claude-code , ai-sdk-workflow-harness , allure-codeceptjs , analogjs-storybook-angular , analogjs-vite-plugin-angular , angular-create , angular-devkit-build-angular , angular-devkit-build-webpack , angular-eslint , angular-eslint-builder , angular-eslint-schematics , apollo-server , apollo-server-cloud-functions , apollo-server-express , apollo-server-integration-koa , apollo-server-lambda , appium , appium-base-driver , appium-base-plugin , appium-chromedriver , appium-execute-driver-plugin , appium-fake-driver , appium-fake-plugin , appium-relaxed-caps-plugin , appium-remote-debugger , as-integrations-fastify , async-storage , aws-cdk , b4a , babel-plugin-remove-graphql-queries , babel-preset-expo , bare-fs , bare-stream , blake2b , blake2b-wasm , blockchain-link-utils , body-parser , braintrust-openai-agents , braintrust-otel , braintrust-sdk-javascript , braintrust-temporal , broccoli , browserbasehq-stagehand , browsers , bull-board-cli , bull-board-express , cbt_tunnels , celo-celocli , celo-connect , celo-contractkit , celo-dev-utils , celo-encrypted-backup , celo-explorer , celo-governance , celo-identity , celo-keystores , celo-phone-number-privacy-common , celo-wallet-base , celo-wallet-hsm-azure , celo-wallet-hsm-gcp , celo-wallet-ledger , celo-wallet-local , celo-wallet-remote , celo-wallet-rpc , chain-jslib , chat-adapter-teams , claude-agent-sdk-typescript , clerk-agent-toolkit , clerk-express , cline , cline-sdk , cloudflare-ai-chat , cloudflare-codemode , cloudflare-think , cloudflare-voice , cloudflare-voice-twilio , cloudflare/agents , codeceptjs , coin-modules , composio , composio-anthropic , composio-claude-agent-sdk , configure , connect , connect-es , connectrpc-connect-express , copilotkit-agentcore-runner , copilotkit-channels , copilotkit-channels-intelligence , copilotkit-channels-slack , copilotkit-channels-teams , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , create-react-app , developer-tooling , docsearch , docusaurus , docusaurus-core , docusaurus-plugin-content-blog , docusaurus-plugin-content-docs , docusaurus-plugin-content-pages , docusaurus-plugin-css-cascade-layers , docusaurus-plugin-debug , docusaurus-plugin-google-analytics , docusaurus-plugin-google-gtag , docusaurus-plugin-google-tag-manager , docusaurus-plugin-sitemap , docusaurus-plugin-svgr , docusaurus-preset-classic , docusaurus-search-local , docusaurus-theme-classic , docusaurus-theme-common , docusaurus-theme-mermaid , docusaurus-theme-search-algolia , earendil-works-pi-agent-core , earendil-works-pi-ai , ecosystem , electron-webpack , ember-cli , eslint-mcp , eth-lib , ethereumjs-client , executor , executor-js-plugin-mcp , expect-webdriverio , expo , expo-asset , expo-cli , expo-constants , expo-dev-server , expo-dev-tools , expo-electron-adapter , expo-expo-cli , expo-file-system , expo-font , expo-glass-effect , expo-linking , expo-localization , expo-modules-core , expo-modules-jsi , expo-next-adapter , expo-pwa , expo-router , expo-router-server , expo-splash-screen , expo-status-bar , expo-symbols , expo-webpack-config , expo-widgets , expo-xdl , expo-yarn-workspaces , ext-apps , files-sdk , firebase-functions , flmngr-flmngr-server-node , forge , gatsby , gatsby-cli , gatsby-cypress , gatsby-interface , gatsby-plugin-compile-es6-packages , gatsby-plugin-emotion , gatsby-plugin-fathom , gatsby-plugin-feed , gatsby-plugin-google-gtag , gatsby-plugin-guess-js , gatsby-plugin-less , gatsby-plugin-manifest , gatsby-plugin-netlify , gatsby-plugin-no-sourcemaps , gatsby-plugin-offline , gatsby-plugin-page-creator , gatsby-plugin-postcss , gatsby-plugin-preact , gatsby-plugin-preload-fonts , gatsby-plugin-react-helmet , gatsby-plugin-schema-snapshot , gatsby-plugin-sharp , gatsby-plugin-sitemap , gatsby-plugin-styletron , gatsby-plugin-typography , gatsby-react-router-scroll , gatsby-remark-code-repls , gatsby-remark-embed-snippet , gatsby-remark-prismjs , gatsby-remark-responsive-iframe , gatsby-sharp , gatsby-source-contentful , gatsby-source-drupal , gatsby-source-filesystem , gatsby-source-graphql , gatsby-source-shopify , gatsby-source-wordpress , gatsby-transformer-react-docgen , gatsby-transformer-remark , gatsby-transformer-sqip , gatsby-transformer-toml , google-adk , google-cloud-functions-framework , google-cloud-vertexai , graphql-hive-apollo , graphql-inspector , graphql-mesh , graphql-mesh-transport-sqlite , graphql-mesh-tuql , graphql-playground-middleware-express , grunt-karma , harness-sdk , hiero-sdk-js , ionic-lab , ionic-v1-toolkit , js-genai , json-render-mcp , karma , karma-browserstack-launcher , karma-jasmine , karma-junit-reporter , karma-mocha-reporter , karma-requirejs , leafygreen-ui , ledger-cosmos-js , ledger-live , ledgerhq-coin-celo , ledgerhq-crypto-icons-ui , ledgerhq-domain-service , ledgerhq-live-cli , ledgerhq-live-common , lg-tools-storybook-addon , loaders.gl-tile-converter , logtape-express , loopback , loopback-connector-remote , lynx-js-docs-mcp-server , lynx-js-genui , lynx-js-rspeedy , masked-view , mastra , mastra-ai-sdk , mastra-blaxel , mastra-braintrust , mastra-client-js , mastra-code-sdk , mastra-connect , mastra-core , mastra-discord , mastra-express , mastra-factory , mastra-files-sdk , mastra-github-signals , mastra-hono , mastra-longmemeval , mastra-mcp , mastra-mcp-docs-server , mastra-nestjs , mastra-observability , mastra-openai , mastra-opencode , mastra-parallel , mastra-playground-ui , mastra-react , mastra-server-adapters-test-suite , mastra-slack , mastra-tavily , mastra-teams , mastracode , mdx , metamask-core , metamask-snaps-cli , metamask-snaps-jest , microsoft-365-agents-toolkit , middleware , mistralai-mistralai , mockttp , modelcontextprotocol-ext-apps , modelcontextprotocol-server-legacy , modern.js , mongodb-data-service , mongodb-js-connection-form , mongodb-js-connection-info , mongodb-js-devtools-connect , mongodb-js-oidc-plugin , mongosh , mongosh-browser-runtime-electron , mongosh-editor , mongosh-logging , mui-mcp , nestjs-apollo , nestjs-platform-express , netlify-cms-proxy-server , nguniversal , node-archiver , node-slack-sdk , npm:@as-integrations/express4 , npm:gatsby-theme-blog-core , nuxt , nx , nx-module-federation , nx-rspack , octanejs-docusaurus , octanejs-mcp-server , office-addin-debugging , office-addin-dev-settings , open-wc-testing-karma , open-wc-testing-karma-bs , openai-agents , openai-agents-extensions , openai-agents-js , openai-agents-openai , openai-agents-realtime , opencensus-node , openuidev-lang-core , orama-orama , pandacss-dev , pandacss-mcp , pi , pi-mcp-adapter , postgraphile , probot , puppeteer-core , remix , remotion-cloudrun , remotion-mcp , reown-appkit , reown-appkit-controllers , reown-appkit-scaffold-ui , reown-appkit-ui , reown-appkit-utils , rock-js-plugin-metro , rsdoctor , rsdoctor-core , rsdoctor-rspack-plugin , rsdoctor-sdk , rsdoctor-webpack-plugin , rspack-cli , rspack-dev-server , rules_nodejs , rushstack , rushstack-heft-rspack-plugin , rushstack-heft-vscode-extension-rig , rushstack-heft-web-rig , rushstack-heft-webpack4-plugin , rushstack-heft-webpack5-plugin , rushstack-lockfile-explorer , rushstack-rush-serve-plugin , sb , sdk-typescript , sentry-gatsby , servify , shadcn , sharp , slack-bolt , storybook , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-interactions , storybook-angular , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-cli , storybook-core , storybook-core-common , storybook-core-server , storybook-ember , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-nextjs , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-create-react-app , storybook-preset-server-webpack , storybook-react , storybook-react-vite , storybook-react-webpack5 , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-telemetry , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , strapi-plugin-graphql , streamx , strong-remoting , stx-labs-stacks.js , styled-components , swarm-js , tanstack-ai , tanstack-ai-acp , tanstack-ai-claude-code , tanstack-ai-codex , tanstack-ai-grok-build , tanstack-ai-mcp , tanstack-ai-opencode , tanstack-ai-sandbox , tanstack-ai-sandbox-blaxel , tanstack-ai-sandbox-boxd , tanstack-ai-sandbox-cloudflare , tanstack-ai-sandbox-daytona , tanstack-ai-sandbox-local-process , tanstack-ai-sandbox-railway , tanstack-ai-sandbox-sprites , tanstack-ai-sandbox-vercel , tar-fs , tar-stream , teams.ts , teex , temporalio-google-adk-agents , testem , text-decoder , theme-ui , thrift-server , tiny-lr , torus-embed , torus.js , transloadit-mcp-server , trezor-connect-web , trezor-env-utils , trezor-suite , tsoa-runtime , tsrx-mcp , tty-table , tuql , typescript-sdk , unstorage , uploadthing , uppy-companion , vercel , vercel-remix-builder , verdaccio , verdaccio-api , verdaccio-audit , verdaccio-cli , verdaccio-server , verdaccio-test-helper , verdaccio-web , wallet-adapter , walletconnect-core , walletconnect-monorepo , walletconnect-sign-client , walletconnect-solana-adapter , walletconnect-types , walletconnect-universal-provider , walletconnect-utils , walletconnect-utils-scoped , wdio-config , wdio-crossbrowsertesting-service , wdio-globals , wdio-local-runner , wdio-runner , wdio-static-server-service , wdio-utils , web-storybook-builder , web3 , web3-bzz , web3-react , webdriver , webdriverio , webpack-bundle-analyzer , webpack-dev-server , weinre2 , whistle , wordpress-env , wordpress-scripts , workflow , workflow-cli , workflow-nitro , workflow-nuxt , workflow-web , workflow-world-testing , wp-playground-cli , wp-playground-mcp , x402-express , x402-mcp , xdl , zbsearch-plugin-docusaurus , zmarkdown

Affected packages:

express @ 3.21.2 (+5059 more)