{"id":"CVE-2026-12590","aliases":["GHSA-v422-hmwv-36x6"],"title":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","summary":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","severity":"low","cvss":3.7,"cwe":["CWE-770"],"vendor":"body-parser","product":"body-parser","ecosystem":"npm","affected":["body-parser < 1.20.6","body-parser >= 2.0.0, < 2.3.0"],"patched":["body-parser 1.20.6","body-parser 2.3.0"],"published":"2026-07-20","updated":"2026-07-20","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-v422-hmwv-36x6","references":[{"url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590"},{"url":"https://github.com/expressjs/body-parser/pull/698"},{"url":"https://github.com/expressjs/body-parser/pull/741"},{"url":"https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d"},{"url":"https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/body-parser/releases/tag/1.20.6"},{"url":"https://github.com/expressjs/body-parser/releases/tag/v2.3.0"},{"url":"https://github.com/advisories/GHSA-v422-hmwv-36x6"}],"tags":["ghsa","npm"],"epss":0.00412,"epssPercentile":0.32892,"ingestedAt":"2026-07-20T23:44:02.286Z","slug":"CVE-2026-12590","body":"## Overview\n\n### Impact\n\nWhen body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.\n\nThis issue affects applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first.\n\n### Patches\n\nThis issue is fixed in [body-parser@2.3.0](https://github.com/expressjs/body-parser/releases/tag/v2.3.0) and [body-parser@1.20.6](https://github.com/expressjs/body-parser/releases/tag/v1.20.6) via [#698](https://github.com/expressjs/body-parser/pull/698). After the fix, invalid `limit` values throw a clear error at parser construction time instead of silently disabling enforcement. `null` and `undefined` continue to fall back to the default limit (`100kb`).\n\n### Workarounds\n\nValidate `limit` before passing it to body-parser. For example, parse the value with [`bytes.parse()`](https://github.com/visionmedia/bytes.js) at startup and reject any configuration where it returns `null` or a non-finite number.\n\n### References\n\n- [#698](https://github.com/expressjs/body-parser/pull/698): fix PR\n- [bytes.js](https://github.com/visionmedia/bytes.js): limit parser\n\n## Affected packages\n\n- `body-parser < 1.20.6`\n- `body-parser >= 2.0.0, < 2.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `body-parser 1.20.6`\n- `body-parser 2.3.0`","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}