CVE-2024-45590: body-parser vulnerable to denial of service when url encoding is enabled

September 10, 2024

body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.

References

github.com/advisories/GHSA-qwcr-r2fm-qrc7
github.com/expressjs/body-parser
github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce
github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
nvd.nist.gov/vuln/detail/CVE-2024-45590

Code Behaviors & Features

Detect and mitigate CVE-2024-45590 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →