Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-07-09T10:21:10
body-parser: body-parser: Denial of Service via invalid limit option
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770
Impact: In body-parser versions prior to 1.20.6 (1.x line) and 2.3.0 (2.x line), when the parser is configured with an invalid limit option value such as an unparseable string or NaN, bytes.parse returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bodies will accept arbitrarily large payloads, leading to excessive memory and CPU usage and denial of service. Patches: This issue is fixed in body-parser 1.20.6 and 2.3.0. After the fix, invalid limit values throw a clear error at parser construction time instead of silently disabling enforcement, while null and undefined continue to fall back to the default limit of 100kb. Workarounds: Validate the limit value before passing it to body-parser. For example, parse the value at startup and reject any configuration where the result is null or a non-finite number.
A flaw was found in body-parser. When the parser is configured with an invalid limit option, such as an unparseable string or a non-numeric value, the request body size check is bypassed. This allows a remote attacker to send arbitrarily large payloads, consuming excessive memory and CPU resources. This can lead to a Denial of Service (DoS) condition, making the application unavailable to legitimate users.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Confidential Compute Attestation
Fix deferred
openshift-sandboxed-containers/osc-pccs
Cryostat 4
Fix deferred
body-parser
Cryostat 4
Fix deferred
cryostat/cryostat-openshift-console-plugin-rhel9
Cryostat 4
Fix deferred
cryostat-openshift-console-plugin-npm
Gatekeeper 3
Fix deferred
gatekeeper/gatekeeper-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-solution-server-rhel9
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel8
Migration Toolkit for Applications 8
Fix deferred
mta/mta-ui-rhel9
Migration Toolkit for Containers
Fix deferred
rhmtc/openshift-migration-ui-rhel8
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-must-gather-rhel9
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-operator-bundle
Node HealthCheck Operator
Fix deferred
workload-availability/node-healthcheck-rhel9-operator
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-419-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9
OpenShift Lightspeed
Fix deferred
openshift-lightspeed/lightspeed-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-pf5-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-console-plugin-rhel9
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel8
OpenShift Pipelines
Fix deferred
openshift-pipelines/pipelines-hub-ui-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-transform-jsonata-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-operator-bundle
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-ossmc-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9
OpenShift Service Mesh 3
Fix deferred
openshift-service-mesh/kiali-rhel9-operator
Red Hat AMQ Broker 7
Fix deferred
body-parser
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-24/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-25/lightspeed-rhel8
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-26/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/gateway-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/lightspeed-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-tech-preview/mcp-server-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
automation-eda-controller
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
body-parser
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
body-parser
Red Hat Build of Podman Desktop
Fix deferred
rh-podman-desktop.git
Red Hat Connectivity Link 1
Fix deferred
rhcl-1/rhcl-console-plugin-rhel9
Red Hat Data Grid 8
Fix deferred
body-parser
Red Hat Developer Hub
Fix deferred
rhdh/rhdh-hub-rhel9
Red Hat Discovery 2
Fix deferred
discovery/discovery-ui-rhel9
Red Hat Enterprise Linux 10
Fix deferred
linux-sgx
Red Hat Enterprise Linux 8
Fix deferred
cldr-emoji-annotation
Red Hat Enterprise Linux 8
Fix deferred
dotnet5.0-build-reference-packages
Red Hat Enterprise Linux 8
Fix deferred
dotnet8.0
Red Hat Enterprise Linux 8
Fix deferred
grafana
Red Hat Enterprise Linux 8
Fix deferred
mozjs60
Red Hat Enterprise Linux 8
Fix deferred
pcs
Red Hat Enterprise Linux 9
Fix deferred
gjs
Red Hat Enterprise Linux 9
Fix deferred
linux-sgx
Red Hat Enterprise Linux 9
Fix deferred
pcs
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-cuda-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-rocm-rhel9
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/disk-image-cuda-rhel9
Red Hat Hardened Images
Not affected
dotnet8.0
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
body-parser
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-mlflow-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-agent-installer-ui-rhel9
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console
Red Hat OpenShift Container Platform 4
Fix deferred
openshift4/ose-console-rhel9
Red Hat Openshift Data Foundation 4
Fix deferred
odf4/mcg-core-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/code-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/jetbrains-ide-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Virtualization 4
Fix deferred
container-native-virtualization/kubevirt-console-plugin
Red Hat OpenShift Virtualization 4
Fix deferred
container-native-virtualization/kubevirt-console-plugin-rhel9
Red Hat Quay 3
Fix deferred
quay/quay-rhel8
Red Hat Satellite 6
Fix deferred
satellite/iop-remediations-rhel9
Red Hat Trusted Artifact Signer
Fix deferred
rhtas/rhtas-console-ui-rhel9
Red Hat Trusted Profile Analyzer
Fix deferred
rhtpa/rhtpa-trustification-service-rhel9
Self-service automation portal 2
Fix deferred
ansible-automation-platform/automation-portal
Self-service automation portal 2
Fix deferred
ansible-automation-platform/bootc-automation-portal-rhel9
https://www.cve.org/CVERecord?id=CVE-2026-12590
https://nvd.nist.gov/vuln/detail/CVE-2026-12590
https://cna.openjsf.org/security-advisories.html
https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6