CVE-2026-111181: 
JavaScript vulnerability analysis and mitigation

CVE-2026-111181 is a Denial of Service vulnerability in the body-parser npm package, caused by an uncaught exception triggered by trailing bytes after a compressed request body. A single crafted HTTP request can crash any Node.js application using body-parser with default options, requiring no authentication or matching route. Affected versions include >= 2.0.0, < 2.4.0 and < 1.20.9 of the 1.x branch. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is an uncaught exception (CWE-248) in the decompression pipeline within body-parser. When a request includes a Content-Encoding header (e.g., gzip), the middleware pipes the body into a decompression stream. After the valid compressed frame is decoded and the application responds, trailing bytes in the request reach the already-finished decoder, which emits an error. Because no error listener is attached to the stream at that point, the error is re-thrown as an uncaught exception, terminating the Node.js process. Exploitation requires no privileges, no user interaction, and no specific route — parsing occurs before routing, making every endpoint vulnerable (GitHub Advisory).

Successful exploitation causes immediate process termination of any Node.js application using body-parser with default settings, resulting in complete availability loss (Availability: High). There is no confidentiality or integrity impact. Because no authentication or route matching is required, any internet-exposed application is at risk, and a single request is sufficient to bring down the service (GitHub Advisory).

The vulnerability is trivially exploitable — a single unauthenticated HTTP request with a Content-Encoding header containing one valid compressed frame followed by arbitrary trailing bytes is sufficient to crash the target process. No PoC code, exploit kits, or in-the-wild exploitation have been publicly reported at this time. EPSS score and CISA KEV catalog status are not yet available for this CVE (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Node.js applications using body-parser with default options (i.e., inflate not set to false), which accept compressed request bodies.
2. Craft malicious payload: Construct an HTTP request with a Content-Encoding: gzip header whose body consists of one valid gzip-compressed frame followed by arbitrary trailing bytes (e.g., a few random bytes appended after the valid compressed data).
3. Send the request: Transmit the crafted request to any endpoint of the target application — no specific route is required, as body parsing occurs before routing.
4. Trigger uncaught exception: The valid compressed frame is decoded successfully and the application begins to respond, but the trailing bytes then reach the finished decompression stream, emitting an unhandled error that terminates the Node.js process.
5. Achieve DoS: The application crashes and becomes unavailable until manually restarted or an orchestrator (e.g., PM2, Kubernetes) restarts the process (GitHub Advisory).

• Logs: Sudden Node.js process crash logs with an uncaught exception or Error event originating from a decompression/zlib stream; application logs showing an abrupt termination with no preceding application-level error.
• Network: Inbound HTTP requests with Content-Encoding: gzip (or other compression schemes) to arbitrary endpoints, where the body size is slightly larger than expected for the compressed content (trailing bytes present).
• Process: Unexpected process restarts of the Node.js application, particularly correlated with specific inbound HTTP requests; process managers (PM2, systemd, Kubernetes) logging repeated restarts in a short time window (GitHub Advisory).

Upgrade body-parser to version 2.4.0 (for the 2.x branch) or 1.20.9 (for the 1.x branch), which contain the fix. As an immediate workaround, pass inflate: false to the body-parser middleware to reject all compressed request bodies before any decompression stream is created — this is appropriate only if the application does not need to accept compressed bodies. Prioritize patching for any internet-exposed Node.js application using body-parser with default options (GitHub Advisory).

The advisory was published on October 22, 2026, by UlisesGascon with AI assistance, and remediation was developed by bjohansebas and reviewed by Phillip9587. No significant broader media coverage or notable researcher commentary beyond the GitHub advisory has been identified at this time (GitHub Advisory).