---
id: CVE-2026-12590
aliases:
  - GHSA-v422-hmwv-36x6
title: >-
  body-parser vulnerable to denial of service when invalid limit value silently
  disables size enforcement
summary: >-
  body-parser vulnerable to denial of service when invalid limit value silently
  disables size enforcement
severity: low
cvss: 3.7
cwe:
  - CWE-770
vendor: body-parser
product: body-parser
ecosystem: npm
affected:
  - body-parser < 1.20.6
  - 'body-parser >= 2.0.0, < 2.3.0'
patched:
  - body-parser 1.20.6
  - body-parser 2.3.0
published: '2026-07-20'
updated: '2026-07-20'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-v422-hmwv-36x6'
references:
  - url: >-
      https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12590'
  - url: 'https://github.com/expressjs/body-parser/pull/698'
  - url: 'https://github.com/expressjs/body-parser/pull/741'
  - url: >-
      https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d
  - url: >-
      https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/expressjs/body-parser/releases/tag/1.20.6'
  - url: 'https://github.com/expressjs/body-parser/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-v422-hmwv-36x6'
tags:
  - ghsa
  - npm
epss: 0.00412
epssPercentile: 0.32784
ingestedAt: '2026-07-20T23:44:02.286Z'
---

## Overview

### Impact

When body-parser is configured with an invalid `limit` option value, such as an unparseable string or `NaN`, `bytes.parse()` returns `null` and the request body size check is silently skipped. Applications that rely on `limit` as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service.

This issue affects applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first.

### Patches

This issue is fixed in [body-parser@2.3.0](https://github.com/expressjs/body-parser/releases/tag/v2.3.0) and [body-parser@1.20.6](https://github.com/expressjs/body-parser/releases/tag/v1.20.6) via [#698](https://github.com/expressjs/body-parser/pull/698). After the fix, invalid `limit` values throw a clear error at parser construction time instead of silently disabling enforcement. `null` and `undefined` continue to fall back to the default limit (`100kb`).

### Workarounds

Validate `limit` before passing it to body-parser. For example, parse the value with [`bytes.parse()`](https://github.com/visionmedia/bytes.js) at startup and reject any configuration where it returns `null` or a non-finite number.

### References

- [#698](https://github.com/expressjs/body-parser/pull/698): fix PR
- [bytes.js](https://github.com/visionmedia/bytes.js): limit parser

## Affected packages

- `body-parser < 1.20.6`
- `body-parser >= 2.0.0, < 2.3.0`

## Remediation

Upgrade to a patched release:

- `body-parser 1.20.6`
- `body-parser 2.3.0`