body-parser CVE-2026-111181

Exploitation requires that request-body inflation remain enabled (the default) and that the application use a body-parser body parser; the attacker sends a request with a Content-Encoding such as gzip whose payload is one valid compressed frame followed by trailing bytes. No authentication and no matching route are required because parsing runs before routing, so every endpoint that parses a body is affected under default configuration. The exploitation is LIMITED only where operators have set the body-parser inflate option to false (the documented workaround, which rejects encoded requests before any decompression stream is created) or have already upgraded to 2.4.0 or 1.20.9; applications on vulnerable versions with defaults are exploitable by any remote unauthenticated client.

This is a genuine operational priority despite having no confidentiality or integrity impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) is internally consistent with the vendor description: a single network request, no authentication (PR:N), no user interaction, and low complexity crashes the process, giving a pure high-availability impact (A:H). The vuln.today decision label is 'this_week', which aligns with a reliable, trivially-triggered, unauthenticated DoS affecting default configurations. No EPSS score was provided, so exploitation-probability modeling cannot be incorporated. The CVE is NOT listed in CISA KEV and there is no public exploit identified at time of analysis - the only references are the OpenJS/GHSA advisory and the CNA page, which are vendor advisories, not proof-of-concept code. No SSVC exploitation/automatable/technical-impact decision points were supplied beyond the vendor priority label. The signals are not conflicting: everything points to a real, easily-weaponized availability flaw whose severity is capped at DoS. The main reason it is 'this_week' rather than an emergency is the absence of code execution or data exposure and the lack of confirmed active exploitation, combined with the extreme ease of triggering a crash against any Node.js/Express service using body-parser with defaults.

An unauthenticated attacker sends a single HTTP request to any endpoint of an Express/Node.js application using body-parser with default options, setting Content-Encoding: gzip and a body consisting of one valid compressed frame followed by extra trailing bytes. The application parses and responds normally, but the trailing bytes then hit the already-finished decompression stream, which has no error listener, producing an uncaught exception that terminates the process. No public exploit code is identified at time of analysis, though the vendor advisory fully describes the trigger mechanism.