Skip to content

blog: July 2026 security releases #2452

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
UlisesGascon wants to merge 1 commit into
base: main
Choose a base branch
from
+41 −0
Draft

blog: July 2026 security releases #2452

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions src/content/blog/2026-07-20-security-releases.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
---
title: July 2026 Security Releases
description: A security release for body-parser has been published. We recommend that all users upgrade as soon as possible.
tags: ['security']
authors:
- name: Ulises Gascon
github: UlisesGascon
---

import Alert from '@components/primitives/Alert/Alert.astro';

The Express team has released [body-parser](https://www.npmjs.com/package/body-parser) 1.20.6 and 2.3.0, addressing a denial of service vulnerability triggered by invalid `limit` values.

<Alert type="warning">

We recommend upgrading to the latest version of body-parser to secure your applications. If you have a `package-lock.json`, you can update the dependency by running:

```sh
npm update body-parser
```

</Alert>

The following vulnerability has been addressed:

- [CVE-2026-12590 in body-parser middleware (Low)](#cve-2026-12590-in-body-parser-middleware-low)

## CVE-2026-12590 in body-parser middleware (Low)

**[body-parser](https://www.npmjs.com/package/body-parser) versions `< 1.20.6` and `>= 2.0.0, < 2.3.0` are vulnerable to denial of service when an invalid `limit` value silently disables size enforcement**

When body-parser was configured with an invalid `limit` option value, such as an unparsable string or `NaN`, the internal call to `bytes.parse()` returned `null` and the request body size check was silently skipped. Applications that relied on `limit` as their primary safeguard against oversized request bodies would accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. This affected applications that pass a programmatically computed or user-configurable value to the `limit` option without validating it first. After the fix, invalid `limit` values throw a clear error at parser construction time instead of silently disabling enforcement.

**Affected versions**: `< 1.20.6` and `>= 2.0.0, < 2.3.0`
**Patched versions**: `>= 1.20.6` and `>= 2.3.0`

For more details, see [GHSA-v422-hmwv-36x6](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6).

---

We recommend upgrading to the latest version of body-parser to secure your applications.
Loading