October 23, 2026 at 8:55 PM EDT
Denial-of-service fixes in body-parser and undici
high
Two high-severity Node.js package bugs can crash a process: body-parser with a single compressed request under default settings, and undici when fetching from a malicious server.
body-parser: CVE-2026-111181
- What: CVE-2026-111181. With default settings, a single compressed request can crash the Node.js process. body-parser is used by Express.
- Severity: High (7.5).
- Exploited: Not known to be exploited.
- Fixed in: 1.20.9 and 2.4.0.
- Who should act: Any Node.js service with body-parser in its lockfile, directly or through Express.
undici: CVE-2026-109869
- What: CVE-2026-109869. undici, the HTTP client behind Node.js's built-in
fetch, can crash the process when fetching from a malicious server. - Severity: High (7.5). Risk is lower for services that only fetch from trusted endpoints.
- Exploited: Not known to be exploited.
- Fixed in: 6.29.1, 7.30.1 and 8.12.2.
- Who should act: Node.js servers, including Next.js servers, that fetch from untrusted or user-supplied URLs.
General information only. Confirm fixed versions in the linked official advisories before patching.