body-parser-1.18.3.tgz: 6 vulnerabilities (highest severity is: 7.5) reachable

[mend-for-github-com]

Vulnerable Library - body-parser-1.18.3.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (body-parser version)	Remediation Possible**	Reachability
CVE-2024-45590	High	7.5	Not Defined	0.824%	body-parser-1.18.3.tgz	Direct	1.20.3	✅	Reachable
CVE-2022-24999	High	7.5	Not Defined	14.663%	qs-6.5.2.tgz	Transitive	1.19.0	✅	Reachable
CVE-2026-2391	Low	3.7	Not Defined	0.478%	qs-6.5.2.tgz	Transitive	1.20.4	✅	Reachable
CVE-2025-15284	Low	3.7	Not Defined	0.456%	qs-6.5.2.tgz	Transitive	1.20.4	✅	Reachable
CVE-2026-82417	Medium	5.3	Not Defined	0.261%	qs-6.5.2.tgz	Transitive	N/A*	❌
CVE-2026-12590	Low	3.7	Not Defined	0.412%	body-parser-1.18.3.tgz	Direct	1.20.6	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-45590

Vulnerable Library - body-parser-1.18.3.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ body-parser-1.18.3.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

nexmo-node-quickstart-0.1.0/voice/record-a-call.js (Application)
  -> body-parser-1.18.3/index.js (Extension)
   -> ❌ body-parser-1.18.3/lib/types/urlencoded.js (Vulnerable Component)

Vulnerability Details

body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.

Publish Date: 2024-09-10

URL: CVE-2024-45590

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.824%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qwcr-r2fm-qrc7

Release Date: 2024-09-10

Fix Resolution: 1.20.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

qs-6.5.2/lib/formats.js (Application)
  -> qs-6.5.2/lib/index.js (Extension)
   -> body-parser-1.18.3/lib/types/urlencoded.js (Extension)
    -> body-parser-1.18.3/index.js (Extension)
     -> ❌ nexmo-node-quickstart-0.1.0/voice/record-a-call.js (Vulnerable Component)

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 14.663%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (body-parser): 1.19.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-2391

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

qs-6.5.2/lib/parse.js (Application)
  -> qs-6.5.2/lib/index.js (Extension)
   -> body-parser-1.18.3/lib/types/urlencoded.js (Extension)
    -> body-parser-1.18.3/index.js (Extension)
     -> ❌ nexmo-node-quickstart-0.1.0/voice/record-a-call.js (Vulnerable Component)

Vulnerability Details

Summary
The "arrayLimit" option in qs does not enforce limits for comma-separated values when "comma: true" is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).
Details
When the "comma" option is set to "true" (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., "?param=a,b,c" becomes "['a', 'b', 'c']"). However, the limit check for "arrayLimit" (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in "parseArrayValue", enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.
Vulnerable code (lib/parse.js: lines ~40-50):
The "split(',')" returns the array immediately, skipping the subsequent limit check. Downstream merging via "utils.combine" does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., "?param=,,,,,,,,..."), allocating massive arrays in memory without triggering limits. It bypasses the intent of "arrayLimit", which is enforced correctly for indexed ("a[0]=") and bracket ("a[]=") notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).
PoC
Test 1 - Basic bypass:
Configuration:

• "comma: true"
• "arrayLimit: 5"
• "throwOnLimitExceeded: true"
  Expected: Throws "Array limit exceeded" error.
  Actual: Parses successfully, creating an array of length 26.
  Impact
  Denial of Service (DoS) via memory exhaustion.
  Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-02-12

URL: CVE-2026-2391

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.478%

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7fw-mjwx-w883

Release Date: 2026-02-12

Fix Resolution (qs): 6.14.2

Direct dependency fix Resolution (body-parser): 1.20.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2025-15284

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

qs-6.5.2/lib/utils.js (Application)
  -> qs-6.5.2/lib/parse.js (Extension)
   -> qs-6.5.2/lib/index.js (Extension)
    -> body-parser-1.18.3/lib/types/urlencoded.js (Extension)
     -> body-parser-1.18.3/index.js (Extension)
      -> ❌ nexmo-node-quickstart-0.1.0/voice/record-a-call.js (Vulnerable Component)

Vulnerability Details

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.
Summary
The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.
Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.
Details
The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).
Vulnerable code (lib/parse.js:159-162):
if (root === '[]' && options.parseArrays) {
obj = utils.combine([], leaf); // No arrayLimit check
}
Working code (lib/parse.js:175):
else if (index <= options.arrayLimit) { // Limit checked here
obj = [];
obj[index] = leaf;
}
The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.
PoC
const qs = require('qs');
const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });
console.log(result.a.length); // Output: 6 (should be max 5)
Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.
Impact
Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.

Publish Date: 2025-12-29

URL: CVE-2025-15284

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.456%

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6rw7-vpxm-498p

Release Date: 2025-12-29

Fix Resolution (qs): 6.14.1

Direct dependency fix Resolution (body-parser): 1.20.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-82417

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• body-parser-1.18.3.tgz (Root Library)
  • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Vulnerability Details

Summary
"qs.stringify" throws a "TypeError" when it serializes an object whose own "constructor" property has a truthy, non-callable "isBuffer" member. "utils.isBuffer" duck-types buffers by calling "obj.constructor.isBuffer(obj)" after checking only that the property is truthy, so a value such as "{ constructor: { isBuffer: "x" } }" makes the call throw "TypeError: obj.constructor.isBuffer is not a function".
Details
"lib/stringify.js:127" calls "utils.isBuffer" on every non-primitive value it serializes. "utils.isBuffer" ("lib/utils.js:332") reads "obj.constructor.isBuffer" and invokes it without verifying that it is a function. "constructor" and "isBuffer" are ordinary property names, so any object carrying them as own properties reaches the unchecked call.
Such an object can be built from untrusted input. "qs.parse("x[constructor][isBuffer]=y", { plainObjects: true })" or "{ allowPrototypes: true }" keeps the "constructor" key as an own property (the default parse options drop it), and "JSON.parse("{"a":{"constructor":{"isBuffer":"x"}}}")" produces the same shape with no qs option involved. Express 4 with its default "query parser" setting and body-parser with "extended: true" both call "qs.parse" with "allowPrototypes: true", so on those stacks "req.query" and "req.body" can carry the shape directly.
PoC
Fix
"lib/utils.js", applied in e83d321 on "main" and released as v6.16.0:
Real "Buffer", "safer-buffer", and browserify "buffer" polyfill instances serialize exactly as before; only the throw is removed.
Affected versions
">=2.2.5 <6.16.0", fixed in v6.16.0.
The unguarded duck-type was introduced in 3768a75 and first shipped in v2.2.5 (September 2014). v2.2.4 and earlier used "Buffer.isBuffer" and are not affected. Every release from v2.2.5 through v6.15.3 contains the unguarded call.
Impact
An unauthenticated request can make any code path that re-serializes attacker-influenced data with "qs.stringify" (for example, rebuilding a query string from "req.query" for a redirect or an upstream request, or serializing a parsed JSON body) throw synchronously. In a typical Node.js HTTP framework the throw is caught by the framework error boundary and the affected request returns a 500; the process survives and other requests are unaffected. Where the call runs outside an error boundary, such as an "async" Express 4 handler (where the throw becomes an unhandled promise rejection) or a background job, the process exits, so the impact in that case depends on the application error handling rather than on qs.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-08-29

URL: CVE-2026-82417

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.261%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4mjr-xmp4-gh2g

Release Date: 2026-08-29

Fix Resolution: qs - 6.16.0,qs - 6.16.0,https://github.com/ljharb/qs.git - v6.16.0

CVE-2026-12590

Vulnerable Library - body-parser-1.18.3.tgz

Node.js body parsing middleware

Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.18.3.tgz

Sample Path to Dependency File: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

• ❌ body-parser-1.18.3.tgz (Vulnerable Library)

Found in HEAD commit: f1591f9e7e403e0cb110a7c12eea1553838dca6d

Found in base branch: main

Vulnerability Details

Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.

Publish Date: 2026-07-09

URL: CVE-2026-12590

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.412%

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v422-hmwv-36x6

Release Date: 2026-07-09

Fix Resolution: 1.20.6

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.