GHSA-27r3-jxmh-p828: High severity npm/body-parser vulnerability
Impact
A single request can crash any application using body-parser with default options. When a request carries a Content-Encoding (for example gzip), body-parser pipes it into a decompression stream and, after reading the body, leaves that stream piped with no error listener. A payload of one valid compressed frame followed by trailing bytes decodes and the application responds normally, but the trailing bytes then reach the already-finished decoder, which emits an error that is re-thrown as an uncaught exception and terminates the process. No authentication or matching route is required, since parsing runs before routing.
Patches
Fixed in body-parser 2.4.0 and 1.20.9. Upgrade to one of these versions.
Workarounds
Pass inflate: false to the body-parser middleware if the application does not need to accept compressed request bodies. This rejects encoded requests before any decompression stream is created.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/body-parserto a version that resolves this vulnerability.Fixed in 1.20.9 - Upgrade
Upgrade
npm/body-parserto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
body-parserto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
body-parserto a version that resolves this vulnerability.Fixed in 1.20.9 - Configuration
Pass inflate: false to the body-parser middleware if the application does not need to accept compressed request bodies.
body-parser middleware inflate = false
Event History
Frequently Asked Questions
Which applications are exposed?
Any application using body-parser with its default options is exposed if it accepts requests that body-parser processes. The issue occurs before routing, so no particular endpoint or route needs to exist.
What does an attacker need to send to trigger the crash?
An unauthenticated remote attacker can send a request with a Content-Encoding such as gzip whose body contains one valid compressed frame followed by trailing bytes. The request can appear to complete normally before the decoder error terminates the process.
Is the default configuration affected?
Yes. The advisory states that a single request can crash applications using body-parser with default options because encoded request bodies are decompressed by default.
What can be done if upgrading is not immediately possible?
Configure the body-parser middleware with inflate: false if compressed request bodies are not required. This rejects encoded requests before a decompression stream is created.
Which versions contain the fix?
Upgrade body-parser to version 2.4.0 or 1.20.9.