{"uuid": "c5126b0d-26c7-4c15-a95b-475adc39a4dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-12590", "type": "seen", "source": "https://gist.github.com/alon710/b2e2ae2f4c7c5ec01435305f8e986e39", "content": "# CVE-2026-12590: CVE-2026-12590: Fail-Open Limit Enforcement Vulnerability in body-parser\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-07-20\n> **Full Report:** https://cvereports.com/reports/CVE-2026-12590\n\n## Summary\nA vulnerability in the 'body-parser' Node.js middleware allows unauthenticated attackers to trigger a Denial of Service. When the 'limit' configuration option is misconfigured with an unparseable type or empty value, size limits fail open. This leads to unrestricted heap memory allocation and process crash via Out of Memory (OOM).\n\n## TL;DR\nUnparseable limit configurations in the body-parser middleware fail open silently. Attackers can exploit this to send massive requests, exhausting server memory and crashing the Node.js process.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1**: 3.7 (Low)\n- **EPSS Score**: 0.0025 (Percentile: 16.43%)\n- **Exploit Status**: PoC-only\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Applications utilizing Express.js with body-parser\n- Node.js software packages with body-parser dependencies prior to 1.20.6\n- Node.js software packages with body-parser dependencies starting at 2.0.0 and prior to 2.3.0\n- **body-parser**: < 1.20.6 (Fixed in: `1.20.6`)\n- **body-parser**: >= 2.0.0 < 2.3.0 (Fixed in: `2.3.0`)\n\n## Mitigation\n\n- Upgrade the body-parser dependency to secure versions 1.20.6+ or 2.3.0+\n- Validate environment variables and configuration inputs before passing them to the middleware initialization block\n- Implement network-level request body size limits in reverse proxies or API gateways\n\n**Remediation Steps:**\n1. Scan the project dependencies using 'npm audit' or 'yarn audit' to identify vulnerable body-parser installations\n2. Update package.json dependencies to require body-parser >= 1.20.6 or body-parser >= 2.3.0\n3. Run 'npm install' or 'yarn install' to pull the patched dependency versions\n4. Review initialization parameters for body-parser and replace dynamic configuration patterns with validated, deterministic values\n5. Deploy the updated application and monitor start logs for validation errors during initialization\n\n## References\n\n- [GitHub Security Advisory: body-parser Denial of Service vulnerability](https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [NVD - CVE-2026-12590 Detailed Report](https://nvd.nist.gov/vuln/detail/CVE-2026-12590)\n- [CVE-2026-12590 Record](https://www.cve.org/CVERecord?id=CVE-2026-12590)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-12590) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-21T05:31:05.531262Z"}