body-parser CVE-2026-12590

Exploitation requires that the target application has configured body-parser with an invalid limit option value - specifically, a string that cannot be parsed into a valid byte count (e.g., an unresolved environment variable, a placeholder token, an empty string) or a non-finite number such as NaN. The application must also rely on body-parser's limit as its primary or sole control against oversized request bodies. Applications using valid limit values (e.g., '1mb', '100kb', a numeric integer) are not affected. Deployments behind a reverse proxy or load balancer that independently enforces request body size limits are protected regardless of body-parser configuration. The CVSS PR:N indicates no authentication is required from the attacker's perspective - any client able to reach the HTTP endpoint can send an oversized body once the misconfiguration precondition is met.

The CVSS 3.7 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L appropriately captures the conditional nature of this vulnerability. AC:H reflects a critical constraint: exploitation requires the application to be misconfigured with an invalid limit value (e.g., a non-numeric environment variable, an unresolved config token, or NaN). Applications with valid limit configurations or additional upstream payload size controls (reverse proxy limits, WAF rules, load balancer request size caps) are not affected. The availability impact is rated Low, consistent with a DoS that depends on a non-default precondition. No EPSS score was provided in the input data, limiting probabilistic exploitation assessment. The vulnerability is not listed in CISA KEV and no POC has been identified, suggesting it has not yet attracted opportunistic exploitation. Real-world risk is concentrated in applications that source the limit value from environment variables or external configuration without validation, where an invalid value could be silently introduced during deployment.

An attacker identifies a Node.js/Express application that sources its body-parser limit value from an environment variable set to an invalid or unresolved string. The attacker sends a stream of HTTP POST requests with multi-gigabyte JSON or URL-encoded bodies. Because bytes.parse returns null for the invalid limit, body-parser accepts each payload without truncation, consuming server heap memory and CPU for parsing, ultimately causing memory exhaustion and service unavailability for legitimate users.