body-parser CVE-2026-12590

Upgrade body-parser to version 1.20.6 (for 1.x consumers) or 2.3.0 (for 2.x consumers), as confirmed by the OpenJS Foundation advisory at https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6. After the fix, invalid limit values throw a clear error at parser construction time, allowing deployment pipelines to catch misconfiguration before requests are served. If an immediate upgrade is not possible, the advised workaround is to validate the limit value at application startup - parse the value explicitly (e.g., using the bytes library) and terminate or refuse to start if the result is null or a non-finite number. This validation should be treated as defense-in-depth regardless of patching, since the underlying risk is configuration hygiene. Additionally, configuring an upstream reverse proxy (nginx, Caddy, AWS ALB) or load balancer with an independent request body size limit provides a compensating control that remains effective even if body-parser's limit is silently bypassed.