StackPrism

npm package

body-parser vulnerabilities by version

The latest release, 2.3.0 (Jun 15, 2026), has no known vulnerabilities. 43% of last week’s 148.7M downloads went to versions with known vulnerabilities. OSV.dev lists 3 advisories for body-parser; the newest was published on Jul 20, 2026.

npm (opens in a new tab) describes it as “Node.js body parsing middleware”

Latest release
2.3.0
Jun 15, 2026, no known vulnerabilities
Downloads last week
148.7M
All versions, from npm
Advisories on OSV.dev
3
Newest Jul 20, 2026
Licence
MIT
OpenSSF Scorecard
7.4/10
expressjs/body-parser (opens in a new tab)

Most-downloaded versions last week

From npm’s per-version download counts for the last 7 days, each checked against OSV.dev. Open a version for its advisories and what to upgrade to.

VersionKnown vulnerabilitiesDownloads
2.3.0latestJun 15, 2026No known vulnerabilities54.7M
1.20.8Sep 8, 2026No known vulnerabilities18.6M
2.2.2Jan 7, 20261 known vulnerability, worst rated low18.4M
1.20.6Jul 9, 2026No known vulnerabilities11.1M
1.20.3Sep 9, 20241 known vulnerability, worst rated low9.7M
1.20.4Dec 1, 20251 known vulnerability, worst rated low8.2M
1.20.5Apr 24, 20261 known vulnerability, worst rated low7.7M
2.2.0Mar 27, 20252 known vulnerabilities, worst rated warning7.3M

Who is still on a vulnerable body-parser

43% of last week’s 148.7M body-parser downloads went to versions with known vulnerabilities.

From npm’s per-version download counts for the last 7 days, each version checked against OSV.dev. The versions checked cover over 99% of downloads.

Release lines

The newest release of each major line, from the registry. body-parser doesn’t publish support dates we can check.

LineNewest releaseReleased
22.3.0Jun 15, 2026
11.20.8Sep 8, 2026

Newest advisories

The 3 most recently published, with the versions each one affects.

  1. LowCVE-2026-12590 on OSV.dev (opens in a new tab)GHSA-v422-hmwv-36x6

    body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement

    Affects < 1.20.6; >= 2.0.0, < 2.3.0. Published Jul 20, 2026.

  2. WarningCVE-2025-13466 on OSV.dev (opens in a new tab)GHSA-wqch-xfxh-vrr4

    body-parser is vulnerable to denial of service when url encoding is used

    Affects >= 2.2.0, < 2.2.1. Published Nov 25, 2025.

  3. CriticalCVE-2024-45590 on OSV.dev (opens in a new tab)GHSA-qwcr-r2fm-qrc7

    body-parser vulnerable to denial of service when url encoding is enabled

    Affects < 1.20.3. Published Sep 10, 2024.

Which body-parser do you have?

Paste a public GitHub repo or drop your package.json and see every vulnerable, end-of-life or deprecated dependency, with one fix task for your coding agent. Free, no sign-up.

Check your whole repo

How this page is checked

StackPrism reads every OSV.dev advisory for body-parser, merges duplicates filed under several ids, and asks OSV.dev which ones affect each version listed. Releases and their dates come from deps.dev, downloads from npm. No AI writes this page: every sentence comes from that data, refreshed every few hours.

Last checked against OSV.dev, CISA KEV, npm and deps.dev.